ClickOnce Applications - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/clickonce-applications/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 08 Jul 2026 08:08:13 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgUnderstanding ClickOnce Technology Abuse: Part 1https://feed.craftedsignal.io/briefs/2026-07-clickonce-abuse-part1/Wed, 08 Jul 2026 08:08:13 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-clickonce-abuse-part1/Threat actors are abusing Microsoft's ClickOnce deployment technology to spread malware, allowing malicious applications to be deployed easily with minimal user interaction and without requiring administrative privileges, ultimately delivering malicious payloads onto user endpoints.Microsoft's ClickOnce technology, designed for simplified application distribution and updating, is being actively abused by threat actors to spread malware. This deployment mechanism allows developers to package and deliver applications that users can run, install, and automatically update with minimal interaction and without requiring administrative privileges. While intended to streamline legitimate software deployment, its user-friendly nature makes it a "double-edged sword," providing an easy vector for malicious payloads. This initial brief, Part 1 of a two-part series, focuses on the internal workings of ClickOnce technology, detailing the process from application publication to installation on the user's endpoint, laying the groundwork for understanding how adversaries weaponize this feature.

Attack Chain

  1. Threat actors publish a malicious application using the ClickOnce technology, generating ClickOnce deployment files (e.g., .application manifest) configured for malware delivery.
  2. The malicious ClickOnce deployment files are hosted on attacker-controlled websites or network shares, impersonating legitimate software or updates.
  3. A user is socially engineered or lured to click an "Install" button or a link pointing to the malicious ClickOnce deployment file.
  4. The user's system downloads the .application manifest file and associated application files.
  5. The operating system may display a security prompt or confirmation dialog to the user, especially if the publisher's signature is untrusted or missing.
  6. The user confirms or bypasses the security prompt, which initiates the ClickOnce deployment process via dfsvc.exe.
  7. The malicious ClickOnce application is executed on the user's system and optionally installed into the C:\Users\<user>\AppData\Local\Apps\2.0\ directory, often without requiring administrative privileges.
  8. The deployed malicious application proceeds to deliver its payload, leading to unauthorized code execution, system compromise, or further malware installation.

Impact

The abuse of ClickOnce technology allows threat actors to bypass traditional security controls that rely on administrative privileges for software installation. Successful exploitation can lead to the silent deployment of malware, including but not limited to ransomware, infostealers, or remote access Trojans. Victims face potential data exfiltration, system damage, disruption of operations, and further lateral movement within their networks. The seamless, user-driven nature of ClickOnce deployments makes it an effective initial access and execution vector, increasing the risk of widespread compromise.

Recommendation

  • Enable process_creation logging to monitor for suspicious invocations or child processes of dfsvc.exe, which is integral to ClickOnce deployments.
  • Implement file_event logging for the C:\Users\*\AppData\Local\Apps\2.0\ directory to track the creation and modification of ClickOnce application files, as this is a common installation path.
  • Monitor network_connection logs for outbound connections initiated by dfsvc.exe or applications installed in C:\Users\*\AppData\Local\Apps\2.0\ to unusual or untrusted external destinations.
]]>highadvisoryclickoncemalware-deliverywindowsendpointNew Abuse of the ClickOnce Technology, Part 2: Stop Threat Actors from Clicking Once and Staying Foreverhttps://feed.craftedsignal.io/briefs/2026-07-clickonce-abuse-part2/Wed, 08 Jul 2026 08:07:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-clickonce-abuse-part2/Threat actors are actively exploiting Microsoft's ClickOnce deployment technology, leveraging its low user interaction, lack of privilege requirements, and built-in update mechanisms to deliver malware, establish persistence, and maintain remote access, often executing payloads within legitimate rundll32.exe and dfsvc.exe processes.CrowdStrike has identified new methods of abusing Microsoft's ClickOnce deployment technology, which threat actors are actively leveraging to deliver malware, achieve persistence, and maintain remote access. This abuse exploits ClickOnce's minimal user interaction, ability to deploy without administrative privileges, and built-in updating mechanism. Actors are observed weaponizing .application files and manipulating .appref-ms shortcuts to stealthily execute payloads within legitimate Microsoft processes such as rundll32.exe and dfsvc.exe. The simplified delivery phase bypasses traditional defenses like email filters, and the lack of user awareness regarding ClickOnce installations contributes to the success of these attacks. This ongoing threat highlights a significant vector for initial access and long-term compromise against Windows endpoints.

Attack Chain

  1. Initial Access: Threat actor persuades a user to click a malicious link or button on a webpage, or directly delivers a weaponized .application file via a non-email vector.
  2. Execution (ClickOnce Deployment): The malicious ClickOnce application is downloaded and executed, initiating the deployment process on the victim's machine.
  3. Execution (Payload Launch): The malicious payload embedded within the ClickOnce application is launched, often executing discreetly within the context of legitimate Microsoft processes such as rundll32.exe or dfsvc.exe.
  4. Persistence (Shortcut Creation): An .appref-ms file, configured to launch the malicious ClickOnce application, is created and placed in the user's Start Menu or other auto-run locations (e.g., Startup folder).
  5. Persistence (Update Mechanism Abuse): The threat actor updates the malicious ClickOnce application on their controlled deployment server with new or modified malicious components, including altered command and control (C2) addresses.
  6. Persistence (Re-execution): When the user subsequently launches the ClickOnce application from the Start Menu shortcut, the built-in update mechanism automatically downloads and executes the updated malicious payload without further user authorization.
  7. Command and Control: The executed payload establishes command and control (C2) communications with the attacker's infrastructure, enabling remote access, further lateral movement, or data exfiltration.

Impact

The successful exploitation of ClickOnce technology allows threat actors to bypass common security controls and establish persistent access to compromised systems without requiring administrative privileges. This can lead to the installation of various malware, including remote access tools, information stealers, or ransomware. Organizations face risks of data exfiltration, system takeover, and significant financial or reputational damage, as adversaries can continuously update their malicious applications and maintain a covert presence.

Recommendation

  • Enable Sysmon FileCreate and ProcessCreate event logging on Windows endpoints to capture activity related to ClickOnce deployment and execution.
  • Deploy the Sigma rule "Detect ClickOnce .appref-ms Persistence" to identify suspicious creation or modification of .appref-ms files in auto-run directories.
  • Deploy the Sigma rule "Detect Suspicious Outbound Network Connection from ClickOnce Service" to flag unusual network activity originating from the dfsvc.exe process.
  • Educate users on the risks associated with clicking suspicious links and executing .application files from untrusted sources, emphasizing that these can trigger software installation.
]]>highadvisoryclickoncemicrosoftpersistencedeliverywindowsendpoint