Windows-Exploitation - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/windows-exploitation/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 07 Jul 2026 19:31:46 +0000New Abuse of the ClickOnce Technology, Part 2: Stop Threat Actors from Clicking Once and Staying Foreverhttps://feed.craftedsignal.io/briefs/2026-07-clickonce-abuse/Tue, 07 Jul 2026 19:31:46 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-clickonce-abuse/Threat actors are actively exploiting Microsoft's ClickOnce technology to facilitate malware delivery, achieve persistence, and evade traditional defenses by leveraging its user-friendly deployment, general lack of awareness, and ability to install applications without elevated privileges, often pushing malicious updates via .appref-ms files that execute within legitimate Microsoft process trees such as rundll32.exe and dfsvc.exe.CrowdStrike has observed new abuse of Microsoft's ClickOnce technology by threat actors for malware delivery, persistence, and defense evasion, as detailed in their July 2026 report, "New Abuse of the ClickOnce Technology, Part 2." This method bypasses common protection mechanisms by leveraging ClickOnce's low-friction installation, often requiring only one or two clicks from the target. Adversaries capitalize on the general lack of awareness regarding .application files and ClickOnce behavior, allowing them to install malicious payloads without requiring elevated privileges. A key abuse involves compromising legitimate ClickOnce application servers to push malicious updates via .appref-ms files, ensuring that even initially benign applications can become malicious, executing within trusted rundll32.exe and dfsvc.exe processes. This technique provides attackers with a stealthy and persistent method for maintaining remote access and updating their malware.

Attack Chain

  1. Attacker crafts a malicious ClickOnce application or compromises a legitimate ClickOnce deployment server.
  2. Attacker entices a user to click a misleading link or button on a webpage, leading to the execution of a .application file.
  3. The ClickOnce application initiates its deployment and installation on the user's Windows system.
  4. A .appref-ms shortcut file is dropped into the user's Start Menu (e.g., %APPDATA%\Microsoft\Windows\Start Menu\Programs\) for offline access or persistence.
  5. The attacker pushes a malicious update to the controlled or compromised ClickOnce deployment server.
  6. The user launches the ClickOnce application, either from the Start Menu shortcut, by placing the .appref-ms file in the Startup folder, or via a scheduled task.
  7. The ClickOnce components detect an available update, fetch the malicious payload from the deployment server, and execute it.
  8. The malicious payload executes under legitimate Microsoft processes like rundll32.exe or dfsvc.exe, establishing persistence, command and control, or further compromise.

Impact

The abuse of ClickOnce technology significantly lowers the barrier to entry for attackers, as it enables the deployment of malware without requiring elevated privileges and often bypasses traditional security controls like mailbox filtering systems. If successful, attackers can achieve persistent access to target systems, execute arbitrary code within legitimate Microsoft processes, and maintain remote access with an easily updatable malicious payload. This stealthy execution can lead to data exfiltration, further network compromise, or the deployment of ransomware, impacting targeted organizations across various sectors. The lack of user awareness about ClickOnce installation mechanisms makes this an effective social engineering vector.

Recommendation

  • Deploy the provided Sigma rules to your SIEM to detect suspicious persistence mechanisms leveraging .appref-ms files.
  • Enable Sysmon ProcessCreate and FileCreate event logging to activate the Sigma rules and gain visibility into process execution and file system changes related to ClickOnce.
  • Educate users on the risks associated with clicking links or opening .application files from untrusted sources, emphasizing that software installations should typically require explicit administrative consent.
  • Monitor for unsanctioned ClickOnce applications being installed or updated within your environment, focusing on their origins and behaviors.
]]>highadvisoryclickoncemalware-deliverypersistencewindows-exploitationdefense-evasion