New Abuse of the ClickOnce Technology, Part 2: Stop Threat Actors from Clicking Once and Staying Forever

1. Executive summary

CrowdStrike has published research on continued abuse of Microsoft's ClickOnce application deployment technology as a malware delivery and persistence vector. The technique requires minimal user interaction (one or two clicks), does not require elevated privileges, and provides a built-in update mechanism via .appref-ms shortcuts in the user Start Menu. The malicious payload executes within legitimate Microsoft process trees (rundll32.exe, dfsvc.exe), bypassing mail filtering and .exe-centric endpoint controls. EMEA financial services firms should treat this as a high-priority detection-engineering task: the combination of low-friction delivery, no privilege requirement, and persistent remote-update capability materially raises the bar for detection and response.

2. Regulatory framing

3. Technical analysis & attack chain

Attack chain (confirmed steps from source)

1. Initial access — victim clicks a webpage button or opens a .application file (one or two clicks). Mail filtering is bypassed because the payload is not a traditional .exe.
2. Deployment — ClickOnce framework installs the application under the user profile. No elevated privileges required; standard user account is sufficient.
3. Execution — payload runs within legitimate Microsoft process trees (rundll32.exe, dfsvc.exe), increasing stealth and reducing the likelihood of behavioural alert.
4. Persistence — when the application is configured for offline availability, an .appref-ms shortcut is dropped at %Users%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ (path as written in source; treat as the user-profile Start Menu).
5. Update / C2 pivot — each launch from the Start Menu contacts the controlling server, allowing the actor to swap payloads, rotate C2 addresses, or stage lateral movement without re-infecting the host.

Technical specifics (confirmed)

• Delivery file types: .application (ClickOnce deployment manifest), .appref-ms (application reference shortcut)
• Persistence path: %Users%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ (user-profile Start Menu)
• Legitimate processes abused: rundll32.exe, dfsvc.exe
• Privilege requirement: standard user (no admin)
• Update mechanism: server-controlled on each launch from Start Menu
• User interaction: 1–2 clicks; no installer UI expected by the user

Unconfirmed / single-sourced: The source frames this as a "new abuse" but the supplied excerpt is truncated before the specific novel technique is revealed. The full Part 2 details were not available in the source material; treat any specific payload, named actor, or novel mechanism claim as unconfirmed until the complete publication is reviewed.

4. Mitigation & containment

P1 — within 24h

• Add EDR detection for file creation of .appref-ms under any user Start Menu path (%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\).
• Alert on dfsvc.exe process creation outside of expected software-distribution contexts (e.g., outside SCCM/Intune-managed deployments).
• Block or alert on .application file execution from web-sourced or email-sourced origins via AppLocker / Windows Defender Application Control (WDAC).

P2 — within 72h

• Deploy or refine WDAC policies to block unsigned ClickOnce deployments.
• Add EDR correlation rule: dfsvc.exe → rundll32.exe → outbound network activity within a short window.
• Review mail and web gateway policies to flag, quarantine, or strip .application attachments and embedded ClickOnce launch links.

P3 — within 7 days

• User awareness brief: clicking a webpage button can trigger software installation; .application files are not benign downloads.
• Audit existing .appref-ms shortcuts in Start Menu across the estate and validate publisher signatures against known internal applications.
• Include ClickOnce-delivered payloads in red-team and tabletop scenarios; ensure SOC playbooks cover dfsvc.exe-spawned child processes.

5. Indicators of compromise

file_path  %Users%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\*.appref-ms
process  dfsvc.exe
process  rundll32.exe
file_extension  .application
file_extension  .appref-ms

6. Detection

rule AT_ClickOnce_AppRefMS_Persistence_2026 {
    meta:
        author = "Adverse Trace"
        date = "2026-06-19"
        description = "Detects ClickOnce application reference (.appref-ms) files dropped into the user Start Menu and the dfsvc.exe process used by ClickOnce deployment"
        reference = "https://www.crowdstrike.com/en-us/blog/new-abuse-of-the-clickonce-technology-part-two/"
    strings:
        $ext = ".appref-ms" ascii nocase
        $startmenu1 = "\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\" ascii nocase
        $startmenu2 = "Start Menu\\Programs\\" ascii nocase
        $dfs = "dfsvc.exe" ascii nocase
        $appref = ".application" ascii nocase
    condition:
        $ext and any of ($startmenu*) or $dfs or $appref
}

title: ClickOnce Application Reference File Creation in User Start Menu
id: AT-2026-06-19-124-001
status: experimental
description: Detects creation of .appref-ms files in the user Start Menu, indicating ClickOnce persistence
author: Adverse Trace
date: 2026-06-19
references:

    - https://www.crowdstrike.com/en-us/blog/new-abuse-of-the-clickonce-technology-part-two/
logsource:
    product: windows
    category: file_event
detection:
    selection:
        FileName|endswith: '.appref-ms'
        FilePath|contains|all:

            - '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\'
    condition: selection
falsepositives:

    - Legitimate ClickOnce application deployments by IT or line-of-business app owners
level: high
---
title: Dfsvc.exe Spawning Rundll32 With Outbound Network
id: AT-2026-06-19-124-002
status: experimental
description: Detects dfsvc.exe (ClickOnce) launching rundll32.exe followed by network activity, a ClickOnce abuse pattern
author: Adverse Trace
date: 2026-06-19
references:

    - https://www.crowdstrike.com/en-us/blog/new-abuse-of-the-clickonce-technology-part-two/
logsource:
    product: windows
    category: process_creation
detection:
    selection_parent:
        Image|endswith: '\dfsvc.exe'
    selection_child:
        Image|endswith: '\rundll32.exe'
    condition: selection_parent and selection_child
falsepositives:

    - Rare; legitimate ClickOnce launches are typically user-initiated and short-lived
level: high

7. Sources

• CrowdStrike, "New Abuse of the ClickOnce Technology, Part 2: Stop Threat Actors from Clicking Once and Staying Forever", https://www.crowdstrike.com/en-us/blog/new-abuse-of-the-clickonce-technology-part-two/, 2026-06-18
• CrowdStrike, "New Abuse of the ClickOnce Technology, Part 1: The Inner Workings of ClickOnce Application Deployment", https://www.crowdstrike.com/en-us/blog/new-abuse-of-the-clickonce-technology-part-one/

8. Adverse Trace position

Severity: moderate-to-high for EMEA financial services. The technique combines low-friction delivery, no privilege requirement, and a persistent remote-update channel — a combination that materially raises the bar for detection and response. No specific CVE, scored vulnerability, or named-actor MITRE profile was provided in the source material, so severity is assessed on technique characteristics rather than a CVSS score. Attribution is unconfirmed: no actor profile is supplied. We will monitor for the full Part 2 publication and any associated IOCs, and update this advisory with concrete detection telemetry, additional YARA refinements, and Sigma rule extensions as further technical detail becomes available. Clients should prioritise the P1 detection rules and the WDAC/AppLocker hardening steps in the interim.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.