New Abuse of the ClickOnce Technology, Part 2: Stop Threat Actors from Clicking Once and Staying Forever

CrowdStrike has identified new methods of abusing Microsoft's ClickOnce deployment technology, which threat actors are actively leveraging to deliver malware, achieve persistence, and maintain remote access. This abuse exploits ClickOnce's minimal user interaction, ability to deploy without administrative privileges, and built-in updating mechanism. Actors are observed weaponizing .application files and manipulating .appref-ms shortcuts to stealthily execute payloads within legitimate Microsoft processes such as rundll32.exe and dfsvc.exe. The simplified delivery phase bypasses traditional defenses like email filters, and the lack of user awareness regarding ClickOnce installations contributes to the success of these attacks. This ongoing threat highlights a significant vector for initial access and long-term compromise against Windows endpoints.

Attack Chain

1. Initial Access: Threat actor persuades a user to click a malicious link or button on a webpage, or directly delivers a weaponized .application file via a non-email vector.
2. Execution (ClickOnce Deployment): The malicious ClickOnce application is downloaded and executed, initiating the deployment process on the victim's machine.
3. Execution (Payload Launch): The malicious payload embedded within the ClickOnce application is launched, often executing discreetly within the context of legitimate Microsoft processes such as rundll32.exe or dfsvc.exe.
4. Persistence (Shortcut Creation): An .appref-ms file, configured to launch the malicious ClickOnce application, is created and placed in the user's Start Menu or other auto-run locations (e.g., Startup folder).
5. Persistence (Update Mechanism Abuse): The threat actor updates the malicious ClickOnce application on their controlled deployment server with new or modified malicious components, including altered command and control (C2) addresses.
6. Persistence (Re-execution): When the user subsequently launches the ClickOnce application from the Start Menu shortcut, the built-in update mechanism automatically downloads and executes the updated malicious payload without further user authorization.
7. Command and Control: The executed payload establishes command and control (C2) communications with the attacker's infrastructure, enabling remote access, further lateral movement, or data exfiltration.

Impact

The successful exploitation of ClickOnce technology allows threat actors to bypass common security controls and establish persistent access to compromised systems without requiring administrative privileges. This can lead to the installation of various malware, including remote access tools, information stealers, or ransomware. Organizations face risks of data exfiltration, system takeover, and significant financial or reputational damage, as adversaries can continuously update their malicious applications and maintain a covert presence.

Recommendation

• Enable Sysmon FileCreate and ProcessCreate event logging on Windows endpoints to capture activity related to ClickOnce deployment and execution.
• Deploy the Sigma rule "Detect ClickOnce .appref-ms Persistence" to identify suspicious creation or modification of .appref-ms files in auto-run directories.
• Deploy the Sigma rule "Detect Suspicious Outbound Network Connection from ClickOnce Service" to flag unusual network activity originating from the dfsvc.exe process.
• Educate users on the risks associated with clicking suspicious links and executing .application files from untrusted sources, emphasizing that these can trigger software installation.