Which SIEM platforms have a T1127.002 detection rule?

df00tech provides T1127.002 (ClickOnce) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect ClickOnce (T1127.002)?

Detecting ClickOnce requires the following data sources: Process: Process Creation, Network Traffic: Network Connection Creation, File: File Creation, Microsoft Defender for Endpoint.

What severity and confidence is the T1127.002 detection?

The T1127.002 detection is rated high severity with high confidence.

What are common false positives for T1127.002?

Common false positives for T1127.002 include: Legitimate enterprise ClickOnce applications (internal LOB apps deployed via SharePoint or intranet) where DFSVC.EXE spawns an expected child process; Software update mechanisms that use ClickOnce for self-updating .NET desktop applications (e.g., Visual Studio extensions, internal tooling); Development environments where developers test ClickOnce packages locally, causing DFSVC.EXE network activity to localhost or internal servers.

T1127.002 IBM QRadar · QRadar

Detect ClickOnce in IBM QRadar

Adversaries may use ClickOnce applications (.appref-ms and .application files) to proxy execution of malicious code through DFSVC.EXE, a trusted Windows utility responsible for installing, launching, and updating ClickOnce .NET applications. Because ClickOnce applications operate under limited permissions, they do not require administrative privileges to install, making them attractive for unprivileged execution. Abuse vectors include: luring users to install trojanized ClickOnce apps from malicious websites, invoking ClickOnce directly via rundll32.exe with dfshim.dll,ShOpenVerbApplication1, and placing .appref-ms files in startup folders for persistence.

MITRE ATT&CK

Tactic: Defense Evasion
Technique: T1127 Trusted Developer Utilities Proxy Execution
Sub-technique: T1127.002 ClickOnce
Canonical reference: https://attack.mitre.org/techniques/T1127/002/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  sourceip,
  username,
  "Image" AS process_image,
  "CommandLine" AS command_line,
  "ParentImage" AS parent_image,
  "TargetFilename" AS target_filename,
  "DestinationIp" AS destination_ip,
  "DestinationPort" AS destination_port,
  CASE
    WHEN LOWER("ParentImage") LIKE '%dfsvc.exe%' AND
         LOWER("Image") SIMILAR TO '%(cmd\.exe|powershell\.exe|pwsh\.exe|mshta\.exe|wscript\.exe|cscript\.exe|regsvr32\.exe|rundll32\.exe|certutil\.exe|bitsadmin\.exe|msbuild\.exe|csc\.exe|installutil\.exe)%'
      THEN 'DfsvcSuspiciousChild'
    WHEN LOWER("Image") LIKE '%rundll32.exe%' AND
         (LOWER("CommandLine") LIKE '%dfshim%' OR LOWER("CommandLine") LIKE '%shopenverbapplication%')
      THEN 'RundllDfshimAbuse'
    WHEN LOWER("Image") LIKE '%dfsvc.exe%' AND
         "DestinationIp" IS NOT NULL AND
         NOT ("DestinationIp" LIKE '10.%' OR
              "DestinationIp" LIKE '192.168.%' OR
              "DestinationIp" LIKE '127.%' OR
              LONG(SPLIT("DestinationIp", '.', 1)) BETWEEN 172 AND 172 AND
              LONG(SPLIT("DestinationIp", '.', 2)) BETWEEN 16 AND 31)
      THEN 'DfsvcOutboundNetwork'
    WHEN (LOWER("TargetFilename") LIKE '%.appref-ms%' OR LOWER("TargetFilename") LIKE '%.application%') AND
         (LOWER("TargetFilename") LIKE '%startup%' OR
          LOWER("TargetFilename") LIKE '%\\temp\\%' OR
          LOWER("TargetFilename") LIKE '%\\tmp\\%' OR
          LOWER("TargetFilename") LIKE '%\\downloads\\%')
      THEN 'ApprefSuspiciousLocation'
    ELSE 'Unknown'
  END AS detection_branch
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) LIKE '%Windows%'
  AND starttime > NOW() - 86400000
  AND (
    /* Branch 1 */
    (LOWER("ParentImage") LIKE '%dfsvc.exe%' AND
     LOWER("Image") SIMILAR TO '%(cmd\.exe|powershell\.exe|pwsh\.exe|mshta\.exe|wscript\.exe|cscript\.exe|regsvr32\.exe|rundll32\.exe|certutil\.exe|bitsadmin\.exe|msbuild\.exe|csc\.exe|installutil\.exe)%')
    OR
    /* Branch 2 */
    (LOWER("Image") LIKE '%rundll32.exe%' AND
     (LOWER("CommandLine") LIKE '%dfshim%' OR LOWER("CommandLine") LIKE '%shopenverbapplication%'))
    OR
    /* Branch 3 */
    (LOWER("Image") LIKE '%dfsvc.exe%' AND
     "DestinationIp" IS NOT NULL AND
     NOT ("DestinationIp" LIKE '10.%' OR "DestinationIp" LIKE '192.168.%' OR "DestinationIp" LIKE '127.%'))
    OR
    /* Branch 4 */
    ((LOWER("TargetFilename") LIKE '%.appref-ms%' OR LOWER("TargetFilename") LIKE '%.application%') AND
     (LOWER("TargetFilename") LIKE '%startup%' OR LOWER("TargetFilename") LIKE '%\\temp\\%' OR
      LOWER("TargetFilename") LIKE '%\\tmp\\%' OR LOWER("TargetFilename") LIKE '%\\downloads\\%'))
  )
ORDER BY starttime DESC

high severity medium confidence

QRadar AQL detection for ClickOnce (T1127.002) abuse covering: DFSVC.EXE spawning LOLBin children (RiskScore 80), rundll32.exe loading dfshim.dll (RiskScore 90), DFSVC.EXE outbound public network connections (RiskScore 60), and .appref-ms/.application files in startup or temp paths (RiskScore 70). Correlates Sysmon process create (Event 1), network (Event 3), and file create (Event 11) events.

Data Sources

IBM QRadar SIEMWindows Sysmon via QRadar WinCollectMicrosoft Windows Security Event Log

Required Tables

events

False Positives & Tuning

Enterprise software provisioning systems that deploy applications via ClickOnce and invoke post-install scripts through DFSVC.EXE
Developer workstations where .NET developers frequently test ClickOnce-packaged applications and dfshim.dll invocations are routine
Update mechanisms for legitimate ClickOnce-distributed business applications that connect outbound to vendor update servers

Download portable Sigma rule (.yml)

Other platforms for T1127.002

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1ClickOnce LOLBAS via Rundll32 dfshim.dll
Expected signal: Sysmon Event ID 1: Process Create with Image=rundll32.exe, CommandLine containing 'dfshim.dll,ShOpenVerbApplication1'. Sysmon Event ID 1: Child process DFSVC.EXE spawned by rundll32.exe. Sysmon Event ID 3: Network connection attempt from DFSVC.EXE to 127.0.0.1:8080. Security Event ID 4688 (if command line auditing enabled) for both rundll32.exe and dfsvc.exe.
Test 2DFSVC.EXE Direct Invocation with Remote Manifest
Expected signal: Sysmon Event ID 1: Process Create for dfsvc.exe with command line containing the manifest URL. Sysmon Event ID 3: Outbound TCP connection attempt from dfsvc.exe to 127.0.0.1:8080. Windows Event Log Microsoft-Windows-ClickOnce/Operational: deployment activation event with the source URL.
Test 3Malicious .appref-ms Placed in Startup Folder
Expected signal: Sysmon Event ID 11: File Create event with TargetFilename containing 'Startup\evil.appref-ms'. Sysmon Event ID 1: PowerShell process creating the file. The startup folder path will be: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\evil.appref-ms.
Test 4ClickOnce Cache Enumeration Simulating Post-Install Reconnaissance
Expected signal: Sysmon Event ID 1: PowerShell process with command line showing ClickOnce cache enumeration. Sysmon Event ID 11: File creation of clickonce_enum.txt in %TEMP%. Multiple Sysmon Event ID 10 (Process Access) events as PowerShell reads binaries in the cache directory.

Last updated: 2026-04-19 Research depth: deep

References (7)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1127.002 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect ClickOnce in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1127.002

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1127.002

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

Get new detections in your inbox