ClickOnce application deployment technology provides threat actors with a low-privilege, user-friendly delivery mechanism that bypasses common security controls. The technology's built-in update system, legitimate Microsoft process execution context, and lack of awareness among defenders create multiple abuse vectors including silent payload updates via .appref-ms files, persistence through Startup folder placement, and signature-preserving dependency trojanization. CrowdStrike identifies a new abuse vector involving COM hijacking within the ClickOnce deployment process.
appref-ms
1 post
New Abuse of the ClickOnce Technology, Part 2: Stop Threat Actors from Clicking Once and Staying Forever