T1127.002 — ClickOnce

Tactics: Stealth, Execution · Platforms: Windows

Adversaries may use ClickOnce applications (.appref-ms and .application files) to proxy execution of code through a trusted Windows utility. ClickOnce is a deployment that enables a user to create self-updating Windows-based .NET applications (i.e, .XBAP, .EXE, or .DLL) that install and run from a…

Sub-technique of Trusted Developer Utilities Proxy Execution (T1127).

Sigma detection rules (1)

T1127.002 Trusted Developer Utilities Proxy Execution: ClickOnce

title: "T1127.002 Trusted Developer Utilities Proxy Execution: ClickOnce"
id: 5336a061-0946-4c97-b591-799e102ed70a
description: 'Detects launch of dfsvc.exe or rundll32.exe invoking dfshim.dll,ShOpenVerbApplication. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, KnownClickOnceApps, SuspiciousChildList.'
references:
  - https://attack.mitre.org/techniques/T1127/002
author: Shahrukh Khan
date: 2026-06-27
license: MIT
tags:
  - attack.stealth
  - attack.execution
  - attack.t1127.002

logsource:
  category: process_creation
  product: windows

detection:
  selection_dfsvc:
    Image|endswith: '\dfsvc.exe'
  selection_rundll32_dfshim:
    Image|endswith: '\rundll32.exe'
    CommandLine|contains: 'dfshim'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: (selection_dfsvc or selection_rundll32_dfshim) and not filter_system_account

falsepositives:
  - Legitimate installation/update of internally published ClickOnce apps.

level: medium

Related sub-techniques

Explore