Microsoft ClickOnce: Exploiting Deployment Frameworks for Stealthy Persistence
Threat actors are weaponizing the Microsoft ClickOnce deployment technology to bypass email security gateways and establish stealthy, non-administrative persistence on Windows enterprise endpoints. By abusing legitimate .application and .appref-ms files, attackers trigger the dfsvc.exe (ClickOnce Deployment Service) to download and execute malicious remote manifests. This technique allows for persistent code execution without requiring privilege escalation, effectively evading traditional EDR detection that relies on monitoring high-privilege process creation or known malicious binaries. The exploitation of this trusted framework turns a legitimate deployment mechanism into a covert channel for malware delivery and long-term foothold maintenance.