{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/clickonce-applications/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ClickOnce technology","ClickOnce","Visual Studio","Windows Installer","ClickOnce applications"],"_cs_severities":["high"],"_cs_tags":["clickonce","malware-delivery","windows","endpoint"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eMicrosoft's ClickOnce technology, designed for simplified application distribution and updating, is being actively abused by threat actors to spread malware. This deployment mechanism allows developers to package and deliver applications that users can run, install, and automatically update with minimal interaction and without requiring administrative privileges. While intended to streamline legitimate software deployment, its user-friendly nature makes it a \u0026quot;double-edged sword,\u0026quot; providing an easy vector for malicious payloads. This initial brief, Part 1 of a two-part series, focuses on the internal workings of ClickOnce technology, detailing the process from application publication to installation on the user's endpoint, laying the groundwork for understanding how adversaries weaponize this feature.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThreat actors publish a malicious application using the ClickOnce technology, generating ClickOnce deployment files (e.g., \u003ccode\u003e.application\u003c/code\u003e manifest) configured for malware delivery.\u003c/li\u003e\n\u003cli\u003eThe malicious ClickOnce deployment files are hosted on attacker-controlled websites or network shares, impersonating legitimate software or updates.\u003c/li\u003e\n\u003cli\u003eA user is socially engineered or lured to click an \u0026quot;Install\u0026quot; button or a link pointing to the malicious ClickOnce deployment file.\u003c/li\u003e\n\u003cli\u003eThe user's system downloads the \u003ccode\u003e.application\u003c/code\u003e manifest file and associated application files.\u003c/li\u003e\n\u003cli\u003eThe operating system may display a security prompt or confirmation dialog to the user, especially if the publisher's signature is untrusted or missing.\u003c/li\u003e\n\u003cli\u003eThe user confirms or bypasses the security prompt, which initiates the ClickOnce deployment process via \u003ccode\u003edfsvc.exe\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe malicious ClickOnce application is executed on the user's system and optionally installed into the \u003ccode\u003eC:\\Users\\\u0026lt;user\u0026gt;\\AppData\\Local\\Apps\\2.0\\\u003c/code\u003e directory, often without requiring administrative privileges.\u003c/li\u003e\n\u003cli\u003eThe deployed malicious application proceeds to deliver its payload, leading to unauthorized code execution, system compromise, or further malware installation.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe abuse of ClickOnce technology allows threat actors to bypass traditional security controls that rely on administrative privileges for software installation. Successful exploitation can lead to the silent deployment of malware, including but not limited to ransomware, infostealers, or remote access Trojans. Victims face potential data exfiltration, system damage, disruption of operations, and further lateral movement within their networks. The seamless, user-driven nature of ClickOnce deployments makes it an effective initial access and execution vector, increasing the risk of widespread compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnable \u003ccode\u003eprocess_creation\u003c/code\u003e logging to monitor for suspicious invocations or child processes of \u003ccode\u003edfsvc.exe\u003c/code\u003e, which is integral to ClickOnce deployments.\u003c/li\u003e\n\u003cli\u003eImplement \u003ccode\u003efile_event\u003c/code\u003e logging for the \u003ccode\u003eC:\\Users\\*\\AppData\\Local\\Apps\\2.0\\\u003c/code\u003e directory to track the creation and modification of ClickOnce application files, as this is a common installation path.\u003c/li\u003e\n\u003cli\u003eMonitor \u003ccode\u003enetwork_connection\u003c/code\u003e logs for outbound connections initiated by \u003ccode\u003edfsvc.exe\u003c/code\u003e or applications installed in \u003ccode\u003eC:\\Users\\*\\AppData\\Local\\Apps\\2.0\\\u003c/code\u003e to unusual or untrusted external destinations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-14T06:28:19Z","date_published":"2026-07-08T08:08:13Z","id":"https://feed.craftedsignal.io/briefs/2026-07-clickonce-abuse-part1/","summary":"Threat actors are abusing Microsoft's ClickOnce deployment technology to spread malware, allowing malicious applications to be deployed easily with minimal user interaction and without requiring administrative privileges, ultimately delivering malicious payloads onto user endpoints.","title":"Understanding ClickOnce Technology Abuse: Part 1","url":"https://feed.craftedsignal.io/briefs/2026-07-clickonce-abuse-part1/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":[],"_cs_products":["ClickOnce","ClickOnce technology","Microsoft ClickOnce",".application files",".appref-ms files","ClickOnce applications",".NET Framework","rundll32.exe","dfsvc.exe","Windows","Microsoft ClickOnce Technology","ClickOnce deployment mechanism"],"_cs_severities":["high"],"_cs_tags":["clickonce","microsoft","persistence","delivery","windows","endpoint"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eCrowdStrike has identified new methods of abusing Microsoft's ClickOnce deployment technology, which threat actors are actively leveraging to deliver malware, achieve persistence, and maintain remote access. This abuse exploits ClickOnce's minimal user interaction, ability to deploy without administrative privileges, and built-in updating mechanism. Actors are observed weaponizing \u003ccode\u003e.application\u003c/code\u003e files and manipulating \u003ccode\u003e.appref-ms\u003c/code\u003e shortcuts to stealthily execute payloads within legitimate Microsoft processes such as \u003ccode\u003erundll32.exe\u003c/code\u003e and \u003ccode\u003edfsvc.exe\u003c/code\u003e. The simplified delivery phase bypasses traditional defenses like email filters, and the lack of user awareness regarding ClickOnce installations contributes to the success of these attacks. This ongoing threat highlights a significant vector for initial access and long-term compromise against Windows endpoints.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access:\u003c/strong\u003e Threat actor persuades a user to click a malicious link or button on a webpage, or directly delivers a weaponized \u003ccode\u003e.application\u003c/code\u003e file via a non-email vector.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eExecution (ClickOnce Deployment):\u003c/strong\u003e The malicious ClickOnce application is downloaded and executed, initiating the deployment process on the victim's machine.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eExecution (Payload Launch):\u003c/strong\u003e The malicious payload embedded within the ClickOnce application is launched, often executing discreetly within the context of legitimate Microsoft processes such as \u003ccode\u003erundll32.exe\u003c/code\u003e or \u003ccode\u003edfsvc.exe\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePersistence (Shortcut Creation):\u003c/strong\u003e An \u003ccode\u003e.appref-ms\u003c/code\u003e file, configured to launch the malicious ClickOnce application, is created and placed in the user's Start Menu or other auto-run locations (e.g., Startup folder).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePersistence (Update Mechanism Abuse):\u003c/strong\u003e The threat actor updates the malicious ClickOnce application on their controlled deployment server with new or modified malicious components, including altered command and control (C2) addresses.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePersistence (Re-execution):\u003c/strong\u003e When the user subsequently launches the ClickOnce application from the Start Menu shortcut, the built-in update mechanism automatically downloads and executes the updated malicious payload without further user authorization.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCommand and Control:\u003c/strong\u003e The executed payload establishes command and control (C2) communications with the attacker's infrastructure, enabling remote access, further lateral movement, or data exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of ClickOnce technology allows threat actors to bypass common security controls and establish persistent access to compromised systems without requiring administrative privileges. This can lead to the installation of various malware, including remote access tools, information stealers, or ransomware. Organizations face risks of data exfiltration, system takeover, and significant financial or reputational damage, as adversaries can continuously update their malicious applications and maintain a covert presence.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnable Sysmon \u003ccode\u003eFileCreate\u003c/code\u003e and \u003ccode\u003eProcessCreate\u003c/code\u003e event logging on Windows endpoints to capture activity related to ClickOnce deployment and execution.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect ClickOnce .appref-ms Persistence\u0026quot; to identify suspicious creation or modification of \u003ccode\u003e.appref-ms\u003c/code\u003e files in auto-run directories.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect Suspicious Outbound Network Connection from ClickOnce Service\u0026quot; to flag unusual network activity originating from the \u003ccode\u003edfsvc.exe\u003c/code\u003e process.\u003c/li\u003e\n\u003cli\u003eEducate users on the risks associated with clicking suspicious links and executing \u003ccode\u003e.application\u003c/code\u003e files from untrusted sources, emphasizing that these can trigger software installation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-15T07:14:49Z","date_published":"2026-07-08T08:07:01Z","id":"https://feed.craftedsignal.io/briefs/2026-07-clickonce-abuse-part2/","summary":"Threat actors are actively exploiting Microsoft's ClickOnce deployment technology, leveraging its low user interaction, lack of privilege requirements, and built-in update mechanisms to deliver malware, establish persistence, and maintain remote access, often executing payloads within legitimate rundll32.exe and dfsvc.exe processes.","title":"New Abuse of the ClickOnce Technology, Part 2: Stop Threat Actors from Clicking Once and Staying Forever","url":"https://feed.craftedsignal.io/briefs/2026-07-clickonce-abuse-part2/"}],"language":"en","title":"CraftedSignal Threat Feed - ClickOnce Applications","version":"https://jsonfeed.org/version/1.1"}