Detect ClickOnce in Sumo Logic CSE
Adversaries may use ClickOnce applications (.appref-ms and .application files) to proxy execution of malicious code through DFSVC.EXE, a trusted Windows utility responsible for installing, launching, and updating ClickOnce .NET applications. Because ClickOnce applications operate under limited permissions, they do not require administrative privileges to install, making them attractive for unprivileged execution. Abuse vectors include: luring users to install trojanized ClickOnce apps from malicious websites, invoking ClickOnce directly via rundll32.exe with dfshim.dll,ShOpenVerbApplication1, and placing .appref-ms files in startup folders for persistence.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Sub-technique
- T1127.002 ClickOnce
- Canonical reference
- https://attack.mitre.org/techniques/T1127/002/
Sumo Detection Query
(_sourceCategory="windows/sysmon" OR _sourceCategory="os/windows/sysmon")
| json auto
| where EventID in ("1", "3", "11")
// Branch 1: DFSVC.EXE spawning suspicious children (EventID=1)
| eval IsSuspiciousChild = if(
EventID = "1"
AND matches(toLowerCase(ParentImage), ".*dfsvc\.exe.*")
AND matches(toLowerCase(Image), ".*(cmd\.exe|powershell\.exe|pwsh\.exe|mshta\.exe|wscript\.exe|cscript\.exe|regsvr32\.exe|rundll32\.exe|certutil\.exe|bitsadmin\.exe|msbuild\.exe|csc\.exe|installutil\.exe).*"),
1, 0)
// Branch 2: rundll32 loading dfshim via ShOpenVerbApplication (EventID=1)
| eval IsDfshimAbuse = if(
EventID = "1"
AND matches(toLowerCase(Image), ".*rundll32\.exe.*")
AND (matches(toLowerCase(CommandLine), ".*dfshim.*") OR matches(toLowerCase(CommandLine), ".*shopenverbapplication.*")),
1, 0)
// Branch 3: DFSVC.EXE outbound network to public IP (EventID=3)
| eval IsDfsvcNetwork = if(
EventID = "3"
AND matches(toLowerCase(Image), ".*dfsvc\.exe.*")
AND !matches(DestinationIp, "^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|127\\.)"),
1, 0)
// Branch 4: .appref-ms or .application in suspicious paths (EventID=11)
| eval IsApprefInStartup = if(
EventID = "11"
AND (matches(toLowerCase(TargetFilename), ".*\\.appref-ms$") OR matches(toLowerCase(TargetFilename), ".*\\.application$"))
AND (matches(toLowerCase(TargetFilename), ".*startup.*")
OR matches(toLowerCase(TargetFilename), ".*\\\\temp\\\\.*")
OR matches(toLowerCase(TargetFilename), ".*\\\\tmp\\\\.*")
OR matches(toLowerCase(TargetFilename), ".*\\\\downloads\\\\.*")),
1, 0)
| eval DetectionBranch = if(IsSuspiciousChild=1, "DfsvcSuspiciousChild",
if(IsDfshimAbuse=1, "RundllDfshimAbuse",
if(IsDfsvcNetwork=1, "DfsvcOutboundNetwork",
if(IsApprefInStartup=1, "ApprefSuspiciousLocation", ""))))
| eval RiskScore = if(IsSuspiciousChild=1, 80,
if(IsDfshimAbuse=1, 90,
if(IsDfsvcNetwork=1, 60,
if(IsApprefInStartup=1, 70, 0))))
| where RiskScore > 0
| eval TargetOrCommandLine = if(isNull(TargetFilename), CommandLine, TargetFilename)
| fields _messageTime, Computer, User, Image, TargetOrCommandLine, ParentImage, ParentCommandLine, DestinationIp, DestinationPort, DetectionBranch, RiskScore
| sort by RiskScore desc, _messageTime descSumo Logic detection for ClickOnce (T1127.002) proxy execution abuse. Monitors Sysmon event streams for DFSVC.EXE spawning LOLBin child processes, rundll32.exe loading dfshim.dll, DFSVC.EXE making outbound connections to public IPs, and .appref-ms/.application files written to persistence or temp locations.
Data Sources
Required Tables
False Positives & Tuning
- Automated software deployment pipelines using ClickOnce to push .NET applications that spawn cmd.exe or PowerShell for post-installation configuration
- IT administrators manually invoking rundll32.exe with dfshim.dll to test or troubleshoot ClickOnce application installs
- Legitimate business applications distributed via ClickOnce that create .appref-ms shortcut files in the user's Downloads directory during initial installation
Other platforms for T1127.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1ClickOnce LOLBAS via Rundll32 dfshim.dll
Expected signal: Sysmon Event ID 1: Process Create with Image=rundll32.exe, CommandLine containing 'dfshim.dll,ShOpenVerbApplication1'. Sysmon Event ID 1: Child process DFSVC.EXE spawned by rundll32.exe. Sysmon Event ID 3: Network connection attempt from DFSVC.EXE to 127.0.0.1:8080. Security Event ID 4688 (if command line auditing enabled) for both rundll32.exe and dfsvc.exe.
- Test 2DFSVC.EXE Direct Invocation with Remote Manifest
Expected signal: Sysmon Event ID 1: Process Create for dfsvc.exe with command line containing the manifest URL. Sysmon Event ID 3: Outbound TCP connection attempt from dfsvc.exe to 127.0.0.1:8080. Windows Event Log Microsoft-Windows-ClickOnce/Operational: deployment activation event with the source URL.
- Test 3Malicious .appref-ms Placed in Startup Folder
Expected signal: Sysmon Event ID 11: File Create event with TargetFilename containing 'Startup\evil.appref-ms'. Sysmon Event ID 1: PowerShell process creating the file. The startup folder path will be: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\evil.appref-ms.
- Test 4ClickOnce Cache Enumeration Simulating Post-Install Reconnaissance
Expected signal: Sysmon Event ID 1: PowerShell process with command line showing ClickOnce cache enumeration. Sysmon Event ID 11: File creation of clickonce_enum.txt in %TEMP%. Multiple Sysmon Event ID 10 (Process Access) events as PowerShell reads binaries in the cache directory.
References (7)
- https://attack.mitre.org/techniques/T1127/002/
- https://lolbas-project.github.io/lolbas/Binaries/Dfsvc/
- https://learn.microsoft.com/en-us/visualstudio/deployment/clickonce-security-and-deployment?view=vs-2022
- https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
- https://www.netspi.com/blog/technical-blog/adversary-simulation/all-you-need-is-one-a-clickonce-love-story/
- https://i.blackhat.com/USA-19/Wednesday/us-19-Burke-ClickOnce-And-Youre-In-When-Appref-Ms-Abuse-Is-Operating-As-Intended-wp.pdf
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.002/T1127.002.md
Unlock Pro Content
Get the full detection package for T1127.002 including response playbook, investigation guide, and atomic red team tests.