10 minmedium
New Abuse of the ClickOnce Technology, Part 2: Stop Threat Actors from Clicking Once and Staying Forever
ClickOnce application deployment technology provides threat actors with a low-privilege, user-friendly delivery mechanism that bypasses common security controls. The technology's built-in update system, legitimate Microsoft process execution context, and lack of awareness among defenders create multiple abuse vectors including silent payload updates via .appref-ms files, persistence through Startup folder placement, and signature-preserving dependency trojanization. CrowdStrike identifies a new abuse vector involving COM hijacking within the ClickOnce deployment process.
Conf:medium
Detection / Hunteropenrouter
What Happened
ClickOnce is a Microsoft technology that lets users install software with a single click, without needing administrator rights. Attackers are abusing this technology to deliver malware because it bypasses many security tools that focus on traditional executable files. When a ClickOnce app is set up for offline use, it creates a shortcut file that automatically checks for updates every time the app is opened, which attackers can use to silently push malicious updates. The malware runs inside legitimate Windows processes, making it harder to detect. Researchers have also found ways to add malicious code into the dependencies of legitimately signed applications, keeping the original trusted signature intact. A new abuse involving COM hijacking has also been identified. Organizations should monitor ClickOnce deployments and educate users that clicking web buttons can trigger software installation.
Key Takeaways
- ClickOnce deployment technology does not require elevated privileges, allowing any standard user to install applications via .application or .appref-ms files.
- Threat actors exploit the built-in update mechanism of offline ClickOnce apps: .appref-ms files in the Start Menu fetch updates from the deployment server on each launch, enabling silent payload updates without user prompts.
- Payloads execute within legitimate Microsoft process trees (rundll32.exe and dfsvc.exe), increasing stealth and bypassing traditional endpoint protections that scrutinize .exe files but may overlook .application files.
- Previous research by Nick Powers and Steven Flores (DEF CON 30) showed that trojanizing dependencies of signed ClickOnce applications preserves the original signature, allowing malicious code to execute under a trusted signature.
- The article introduces a new abuse vector involving COM hijacking within the ClickOnce deployment process, identified in the dfdll!BindToServer() function.
Affected Systems
- Microsoft Windows endpoints with ClickOnce technology enabled
- .NET applications deployed via ClickOnce
- Standard user accounts (no administrator privileges required)
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Threat actor delivers a ClickOnce application via phishing or compromised web page, requiring only one or two user clicks to trigger deployment via .application or .appref-ms file
- Execution: Payload executes within legitimate Microsoft process trees (rundll32.exe and dfsvc.exe), bypassing endpoint protections focused on .exe scrutiny
- Persistence: .appref-ms file is dropped in Start Menu Programs folder; threat actor can place it in Startup folder or reference it via scheduled tasks for automated execution
- Maintenance: Each launch of the .appref-ms file fetches updates from the deployment server without user prompts, allowing silent C2 address changes or payload swaps
- Defense Evasion: Dependency hijacking of signed ClickOnce applications preserves the original trusted signature while embedding malicious code in dependencies
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: CrowdStrike Falcon sensor (referenced but not included in article text)
The article references how the CrowdStrike Falcon sensor identifies and responds to ClickOnce threats, but the article text cuts off before detailing specific detection logic or rules. No YARA, Sigma, Snort, Suricata, KQL, SPL, or EQL rules are provided in the visible text.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | ClickOnce payloads execute within legitimate Microsoft processes (rundll32.exe, dfsvc.exe), which may reduce EDR telemetry clarity. Process ancestry and network connections from dfsvc.exe are visible, but distinguishing legitimate ClickOnce deployments from malicious ones requires additional context such as deployment server reputation and dependency analysis. |
| Network Visibility | Medium | ClickOnce deployments and updates involve HTTP/HTTPS traffic to deployment servers. Network telemetry can capture these connections, but the URLs and servers may appear legitimate, especially if a legitimate ClickOnce server has been compromised to serve malicious updates. |
| Detection Difficulty | Hard | ClickOnce execution occurs within legitimate Microsoft-signed processes, making behavioral detection challenging. Legitimate ClickOnce deployments generate identical process patterns. Dependency trojanization preserves valid signatures, defeating signature-based checks. COM hijacking abuse occurs within the deployment process itself, further blending with legitimate activity. Effective detection requires correlation across process, file, network, and registry telemetry. |
Required Log Sources
- Windows process creation events (Sysmon Event ID 1, Security Event ID 4688)
- Process tree telemetry showing parent-child relationships involving dfsvc.exe and rundll32.exe
- File creation events in Start Menu Programs folder and Startup folder (Sysmon Event ID 11)
- Network connection events from dfsvc.exe (Sysmon Event ID 3)
- Scheduled task creation events (Security Event ID 4698)
- Registry modifications for COM hijacking (Sysmon Event ID 12, 13)
- ClickOnce deployment manifest (.application) file download events
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for .appref-ms files placed in the Windows Startup folder or referenced by scheduled tasks, as this indicates persistence via ClickOnce shortcut abuse rather than normal Start Menu placement. | File creation events in Startup folder paths, scheduled task definitions referencing .appref-ms extensions, Sysmon Event IDs 11 and 4698 | Persistence | Low - legitimate ClickOnce apps place .appref-ms in Start Menu Programs, not Startup folder; scheduled task references to .appref-ms are atypical. |
| Consider hunting for network connections initiated by dfsvc.exe to previously unseen or low-reputation domains, which may indicate malicious ClickOnce deployment servers or compromised update endpoints. | Network connection events with process context, Sysmon Event ID 3, EDR network telemetry | Command and Control | Medium - legitimate ClickOnce deployments also generate dfsvc.exe network connections; requires baseline comparison of known deployment servers. |
| Consider hunting for ClickOnce applications whose deployment manifests (.application files) are unsigned or signed by non-Microsoft, non-established publishers, as threat actors often create unsigned ClickOnce apps that trigger SmartScreen warnings. | File download events, certificate validation logs, SmartScreen event logs | Initial Access | Medium - legitimate internal or third-party ClickOnce applications may also be unsigned. |
| Consider hunting for COM hijacking patterns in registry entries associated with ClickOnce deployment components, particularly modifications to HKCR\CLSID keys that redirect to attacker-controlled objects during the dfdll!BindToServer() execution path. | Registry modification events, Sysmon Event IDs 12 and 13, registry hive monitoring for HKCR\CLSID changes | Defense Evasion | Medium - legitimate software installations also modify COM registry entries; correlation with ClickOnce process activity reduces false positives. |
| Consider hunting for ClickOnce applications where dependency files have been modified or added after initial deployment, indicating potential dependency hijacking of a previously trusted application. | File modification events in ClickOnce application cache directories, file hash comparison against known-good dependency hashes | Defense Evasion | Medium - legitimate application updates also modify dependencies; baseline hash comparison is needed. |
Control Gaps
- Traditional AV and email gateway filtering that focuses on .exe attachments may not scan or block .application and .appref-ms files
- Application allowlisting based on signatures may not detect dependency trojanization where the host application retains its valid signature
- SmartScreen checks are bypassed when threat actors trojanize dependencies of signed applications rather than creating unsigned deployments
- Standard user privilege restrictions do not prevent ClickOnce installation, as no elevation is required
- Network security tools may not flag HTTP/HTTPS traffic to ClickOnce deployment servers as suspicious, especially if the server is a compromised legitimate infrastructure
Key Behavioral Indicators
- Process ancestry: dfsvc.exe spawning rundll32.exe with unusual command-line arguments or loading unexpected DLLs
- File creation of .appref-ms files in paths outside the standard Start Menu Programs directory (e.g., Startup folder, Temp)
- Scheduled tasks referencing .appref-ms file extensions as the action payload
- Network connections from dfsvc.exe to domains not previously observed in the environment baseline
- Registry modifications to COM CLSID entries correlated in time with ClickOnce deployment process activity
- New .application file downloads from non-corporate web infrastructure
False Positive Assessment
Medium - ClickOnce is a legitimate Microsoft deployment technology used by many enterprise applications. Process patterns involving dfsvc.exe and rundll32.exe are identical for legitimate and malicious deployments. Effective detection requires baseline comparison of deployment servers, publisher signatures, and file placement patterns rather than simple process or file extension matching.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider hunting for .appref-ms files in the Windows Startup folder and scheduled tasks referencing .appref-ms extensions across your endpoint estate.
- Consider reviewing existing ClickOnce deployments in your environment to establish a baseline of legitimate deployment servers and application publishers.
- If your EDR supports it, consider creating detection rules for .application and .appref-ms file executions outside of known-good deployment server domains.
Infrastructure Hardening
- Evaluate whether ClickOnce technology can be disabled or restricted via Group Policy for users who do not require it, particularly on high-value endpoints.
- Consider implementing application allowlisting that accounts for ClickOnce dependency integrity, not just host application signatures.
- If network inspection capabilities allow, consider monitoring and filtering HTTP/HTTPS traffic to unknown ClickOnce deployment servers (.application manifest downloads).
User Protection
- Consider deploying endpoint protection that specifically monitors process trees involving dfsvc.exe and rundll32.exe for anomalous behavior.
- Evaluate whether SmartScreen and Mark-of-the-Web (MOTW) protections are enabled and enforced for downloaded .application files.
- If supported by your EDR, consider enabling behavioral detection for COM hijacking patterns correlated with ClickOnce process activity.
Security Awareness
- Consider adding ClickOnce awareness to existing security training programs, emphasizing that clicking a web page button can trigger software installation without a visible .exe download.
- Educate users that Microsoft installation prompts triggered from web pages are not inherently safe and should be treated with the same caution as executable downloads.
- Consider advising users to report any unexpected Microsoft installation dialogs, especially those appearing after clicking links in emails or on unfamiliar websites.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping6 techniques
Tactic
Execution
Tactic
Persistence
Tactic
Stealth
Additional IOCs
- File Paths:
%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\- Location where .appref-ms shortcut files are dropped during offline ClickOnce app installation; used by threat actors for persistence and silent update retrieval.
- Other:
.appref-ms- ClickOnce application reference file dropped in Start Menu for offline apps; triggers update fetch and payload execution when opened, used for persistence and silent malicious updates..application- ClickOnce deployment manifest file that can trigger application installation with minimal user interaction; bypasses some security tools that focus on .exe files.dfsvc.exe- Legitimate Microsoft ClickOnce deployment service process that executes ClickOnce payloads; abused by threat actors to run malicious code within a trusted process tree.dfdll!BindToServer()- Function in the ClickOnce deployment DLL where a new COM hijacking abuse vector was identified at the start of the server binding process.
