Detect ClickOnce in CrowdStrike LogScale
Adversaries may use ClickOnce applications (.appref-ms and .application files) to proxy execution of malicious code through DFSVC.EXE, a trusted Windows utility responsible for installing, launching, and updating ClickOnce .NET applications. Because ClickOnce applications operate under limited permissions, they do not require administrative privileges to install, making them attractive for unprivileged execution. Abuse vectors include: luring users to install trojanized ClickOnce apps from malicious websites, invoking ClickOnce directly via rundll32.exe with dfshim.dll,ShOpenVerbApplication1, and placing .appref-ms files in startup folders for persistence.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Sub-technique
- T1127.002 ClickOnce
- Canonical reference
- https://attack.mitre.org/techniques/T1127/002/
LogScale Detection Query
// Branch 1: DFSVC.EXE spawning suspicious child processes
#event_simpleName=ProcessRollup2
| ParentBaseFileName = /dfsvc\.exe/i
| ImageFileName = /(cmd\.exe|powershell\.exe|pwsh\.exe|mshta\.exe|wscript\.exe|cscript\.exe|regsvr32\.exe|rundll32\.exe|certutil\.exe|bitsadmin\.exe|msbuild\.exe|csc\.exe|installutil\.exe)/i
| eval DetectionBranch = "DfsvcSuspiciousChild"
| eval RiskScore = 80
| table([timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, ParentCommandLine, DetectionBranch, RiskScore])
// Union Branch 2: rundll32.exe loading dfshim.dll
| union [
#event_simpleName=ProcessRollup2
| ImageFileName = /rundll32\.exe/i
| CommandLine = /(dfshim|ShOpenVerbApplication)/i
| eval DetectionBranch = "RundllDfshimAbuse"
| eval RiskScore = 90
| table([timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, ParentCommandLine, DetectionBranch, RiskScore])
]
// Union Branch 3: DFSVC.EXE outbound network connections to public IPs
| union [
#event_simpleName=NetworkConnectIP4
| ImageFileName = /dfsvc\.exe/i
| !RemoteIP = /^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)/
| eval DetectionBranch = "DfsvcOutboundNetwork"
| eval RiskScore = 60
| eval CommandLine = ""
| eval ParentBaseFileName = ""
| eval ParentCommandLine = ""
| table([timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, ParentCommandLine, RemoteIP, RemotePort, DetectionBranch, RiskScore])
]
// Union Branch 4: .appref-ms or .application files written to suspicious paths
| union [
#event_simpleName=PeFileWritten OR #event_simpleName=DocumentWritten
| TargetFileName = /\.(appref-ms|application)$/i
| TargetFileName = /(Startup|\\Temp\\|\\tmp\\|\\Downloads\\)/i
| eval DetectionBranch = "ApprefSuspiciousLocation"
| eval RiskScore = 70
| eval CommandLine = TargetFileName
| eval ParentBaseFileName = ""
| eval ParentCommandLine = ""
| table([timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, ParentCommandLine, DetectionBranch, RiskScore])
]
| sort(RiskScore, order=desc)
| sort(timestamp, order=desc)CrowdStrike LogScale (Falcon telemetry) detection for ClickOnce (T1127.002) abuse. Queries ProcessRollup2 for DFSVC.EXE LOLBin children and dfshim.dll rundll32 abuse, NetworkConnectIP4 for DFSVC.EXE outbound public connections, and file write events for .appref-ms/.application in startup or temp paths. Results are unioned and sorted by risk score.
Data Sources
Required Tables
False Positives & Tuning
- Falcon-managed endpoints running legitimate enterprise ClickOnce applications where DFSVC.EXE routinely spawns child processes for update checks or configuration scripts authorized by the app vendor
- Developer machines with Visual Studio or .NET toolchains where ClickOnce manifest testing involves rundll32.exe and dfshim.dll as part of the build-and-test workflow
- Endpoint management tools (e.g., SCCM, Intune supplementary agents) that distribute software via ClickOnce and write .appref-ms shortcuts to user startup folders during provisioning
Other platforms for T1127.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1ClickOnce LOLBAS via Rundll32 dfshim.dll
Expected signal: Sysmon Event ID 1: Process Create with Image=rundll32.exe, CommandLine containing 'dfshim.dll,ShOpenVerbApplication1'. Sysmon Event ID 1: Child process DFSVC.EXE spawned by rundll32.exe. Sysmon Event ID 3: Network connection attempt from DFSVC.EXE to 127.0.0.1:8080. Security Event ID 4688 (if command line auditing enabled) for both rundll32.exe and dfsvc.exe.
- Test 2DFSVC.EXE Direct Invocation with Remote Manifest
Expected signal: Sysmon Event ID 1: Process Create for dfsvc.exe with command line containing the manifest URL. Sysmon Event ID 3: Outbound TCP connection attempt from dfsvc.exe to 127.0.0.1:8080. Windows Event Log Microsoft-Windows-ClickOnce/Operational: deployment activation event with the source URL.
- Test 3Malicious .appref-ms Placed in Startup Folder
Expected signal: Sysmon Event ID 11: File Create event with TargetFilename containing 'Startup\evil.appref-ms'. Sysmon Event ID 1: PowerShell process creating the file. The startup folder path will be: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\evil.appref-ms.
- Test 4ClickOnce Cache Enumeration Simulating Post-Install Reconnaissance
Expected signal: Sysmon Event ID 1: PowerShell process with command line showing ClickOnce cache enumeration. Sysmon Event ID 11: File creation of clickonce_enum.txt in %TEMP%. Multiple Sysmon Event ID 10 (Process Access) events as PowerShell reads binaries in the cache directory.
References (7)
- https://attack.mitre.org/techniques/T1127/002/
- https://lolbas-project.github.io/lolbas/Binaries/Dfsvc/
- https://learn.microsoft.com/en-us/visualstudio/deployment/clickonce-security-and-deployment?view=vs-2022
- https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
- https://www.netspi.com/blog/technical-blog/adversary-simulation/all-you-need-is-one-a-clickonce-love-story/
- https://i.blackhat.com/USA-19/Wednesday/us-19-Burke-ClickOnce-And-Youre-In-When-Appref-Ms-Abuse-Is-Operating-As-Intended-wp.pdf
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.002/T1127.002.md
Unlock Pro Content
Get the full detection package for T1127.002 including response playbook, investigation guide, and atomic red team tests.