1/ #Hardening:
If the Windows App sideloading feature is enabled, users can also install APPX packages not originating not from the Microsoft Store, ideal for distributing malware with these packages 🤯[1],[2]
🧵 #CyberSecurity
If the Windows App sideloading feature is enabled, users can also install APPX packages not originating not from the Microsoft Store, ideal for distributing malware with these packages 🤯[1],[2]
🧵 #CyberSecurity
2/ We can search our network for systems with enabled sideloading:
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock".
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock".
3/
AllowAllTrustedApps:
This value can also be set via GPO if a company wants to distribute trusted line-of-business (LOB) apps that are not from the Windows Store.
However, these apps must still have a valid certificate chain; otherwise, the app will not be loaded.
AllowAllTrustedApps:
This value can also be set via GPO if a company wants to distribute trusted line-of-business (LOB) apps that are not from the Windows Store.
However, these apps must still have a valid certificate chain; otherwise, the app will not be loaded.
4/ The value AllowDevelopmentWithoutDevLicense was set on my test machine as soon as I turned on the sideloading feature.
5/ If you want to find out more about malicious apps, @SentinelOne wrote an excellent article about this topic.
[1] sentinelone.com/labs/inside-ma…
[2]
[1] sentinelone.com/labs/inside-ma…
[2]
https://twitter.com/wdormann/status/1466039420684021761
• • •
Missing some Tweet in this thread? You can try to
force a refresh
