Detect ClickOnce in Microsoft Sentinel
Adversaries may use ClickOnce applications (.appref-ms and .application files) to proxy execution of malicious code through DFSVC.EXE, a trusted Windows utility responsible for installing, launching, and updating ClickOnce .NET applications. Because ClickOnce applications operate under limited permissions, they do not require administrative privileges to install, making them attractive for unprivileged execution. Abuse vectors include: luring users to install trojanized ClickOnce apps from malicious websites, invoking ClickOnce directly via rundll32.exe with dfshim.dll,ShOpenVerbApplication1, and placing .appref-ms files in startup folders for persistence.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Sub-technique
- T1127.002 ClickOnce
- Canonical reference
- https://attack.mitre.org/techniques/T1127/002/
KQL Detection Query
// Branch 1: DFSVC.EXE spawning suspicious child processes
let SuspiciousChildren = dynamic([
"cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe",
"cscript.exe", "regsvr32.exe", "rundll32.exe", "certutil.exe",
"bitsadmin.exe", "msbuild.exe", "csc.exe", "installutil.exe"
]);
let ClickOnceExec = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "dfsvc.exe"
| where FileName in~ (SuspiciousChildren)
| extend DetectionBranch = "DfsvcSuspiciousChild"
| extend RiskScore = 80;
// Branch 2: rundll32.exe invoking dfshim.dll ClickOnce loader
let DfshimAbuse = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "rundll32.exe"
| where ProcessCommandLine has_any ("dfshim", "ShOpenVerbApplication")
| extend DetectionBranch = "RundllDfshimAbuse"
| extend RiskScore = 90;
// Branch 3: DFSVC.EXE making outbound network connections
let DfsvcNetwork = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "dfsvc.exe"
| where RemoteIPType == "Public"
| extend DetectionBranch = "DfsvcOutboundNetwork"
| extend RiskScore = 60
| project Timestamp, DeviceName, AccountName,
FileName = InitiatingProcessFileName,
ProcessCommandLine = InitiatingProcessCommandLine,
InitiatingProcessFileName = "",
InitiatingProcessCommandLine = "",
DetectionBranch, RiskScore,
RemoteUrl, RemoteIP, RemotePort;
// Branch 4: .appref-ms files written to startup or temp locations
let ApprefInStartup = DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName endswith ".appref-ms" or FileName endswith ".application"
| where FolderPath has_any (
"\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
"\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
"\\Temp\\", "\\tmp\\", "\\Downloads\\"
)
| extend DetectionBranch = "ApprefSuspiciousLocation"
| extend RiskScore = 70
| project Timestamp, DeviceName, AccountName = RequestAccountName,
FileName, ProcessCommandLine = InitiatingProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
DetectionBranch, RiskScore,
RemoteUrl = "", RemoteIP = "", RemotePort = int(null);
union kind=outer
(ClickOnceExec | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionBranch, RiskScore, RemoteUrl="", RemoteIP="", RemotePort=int(null)),
DfshimAbuse | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionBranch, RiskScore, RemoteUrl="", RemoteIP="", RemotePort=int(null),
DfsvcNetwork,
ApprefInStartup
| sort by Timestamp descDetects ClickOnce abuse (T1127.002) across four detection branches using Microsoft Defender for Endpoint tables. Branch 1 identifies DFSVC.EXE spawning high-risk child processes (shells, LOLBins) that are unexpected for legitimate ClickOnce deployments. Branch 2 catches direct dfshim.dll invocation via rundll32.exe using the ShOpenVerbApplication export — a documented LOLBAS technique. Branch 3 monitors DFSVC.EXE making outbound public network connections, which may indicate a malicious .application manifest fetching a remote payload. Branch 4 flags .appref-ms or .application files written to startup or temp directories, indicating persistence setup or staging activity.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate enterprise ClickOnce applications (internal LOB apps deployed via SharePoint or intranet) where DFSVC.EXE spawns an expected child process
- Software update mechanisms that use ClickOnce for self-updating .NET desktop applications (e.g., Visual Studio extensions, internal tooling)
- Development environments where developers test ClickOnce packages locally, causing DFSVC.EXE network activity to localhost or internal servers
- IT deployment tools that distribute .appref-ms shortcuts to user desktops or startup folders as part of legitimate software rollout
Other platforms for T1127.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1ClickOnce LOLBAS via Rundll32 dfshim.dll
Expected signal: Sysmon Event ID 1: Process Create with Image=rundll32.exe, CommandLine containing 'dfshim.dll,ShOpenVerbApplication1'. Sysmon Event ID 1: Child process DFSVC.EXE spawned by rundll32.exe. Sysmon Event ID 3: Network connection attempt from DFSVC.EXE to 127.0.0.1:8080. Security Event ID 4688 (if command line auditing enabled) for both rundll32.exe and dfsvc.exe.
- Test 2DFSVC.EXE Direct Invocation with Remote Manifest
Expected signal: Sysmon Event ID 1: Process Create for dfsvc.exe with command line containing the manifest URL. Sysmon Event ID 3: Outbound TCP connection attempt from dfsvc.exe to 127.0.0.1:8080. Windows Event Log Microsoft-Windows-ClickOnce/Operational: deployment activation event with the source URL.
- Test 3Malicious .appref-ms Placed in Startup Folder
Expected signal: Sysmon Event ID 11: File Create event with TargetFilename containing 'Startup\evil.appref-ms'. Sysmon Event ID 1: PowerShell process creating the file. The startup folder path will be: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\evil.appref-ms.
- Test 4ClickOnce Cache Enumeration Simulating Post-Install Reconnaissance
Expected signal: Sysmon Event ID 1: PowerShell process with command line showing ClickOnce cache enumeration. Sysmon Event ID 11: File creation of clickonce_enum.txt in %TEMP%. Multiple Sysmon Event ID 10 (Process Access) events as PowerShell reads binaries in the cache directory.
References (7)
- https://attack.mitre.org/techniques/T1127/002/
- https://lolbas-project.github.io/lolbas/Binaries/Dfsvc/
- https://learn.microsoft.com/en-us/visualstudio/deployment/clickonce-security-and-deployment?view=vs-2022
- https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
- https://www.netspi.com/blog/technical-blog/adversary-simulation/all-you-need-is-one-a-clickonce-love-story/
- https://i.blackhat.com/USA-19/Wednesday/us-19-Burke-ClickOnce-And-Youre-In-When-Appref-Ms-Abuse-Is-Operating-As-Intended-wp.pdf
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.002/T1127.002.md
Unlock Pro Content
Get the full detection package for T1127.002 including response playbook, investigation guide, and atomic red team tests.