Threat actors are weaponizing the Microsoft ClickOnce deployment technology to bypass email security gateways and establish stealthy, non-administrative persistence on Windows enterprise endpoints. By abusing legitimate .application and .appref-ms files, attackers trigger the dfsvc.exe (ClickOnce Deployment Service) to download and execute malicious remote manifests. This technique allows for persistent code execution without requiring privilege escalation, effectively evading traditional EDR detection that relies on monitoring high-privilege process creation or known malicious binaries. The exploitation of this trusted framework turns a legitimate deployment mechanism into a covert channel for malware delivery and long-term foothold maintenance.

• Research & Discovery Overview

  • CrowdStrike Intelligence recently documented novel persistence techniques leveraging the ClickOnce framework.
  • Early research from BlackHat highlighted the inherent risks in .appref-ms file abuse.
  • Elastic Security has contributed to the defense landscape by developing behavioral detection rules for dfsvc.exe anomalies.

• Attack Mechanics & Execution

  • Attackers distribute malicious .application or .appref-ms files, often via email attachments, to trick users.
  • The ClickOnce Deployment Service (dfsvc.exe) processes these files to fetch and execute remote deployment manifests.
  • The attack chain utilizes the legitimate .NET deployment framework to download and run arbitrary code.

• Evasion & Persistence Impact

  • Establishes persistent access within Windows environments without necessitating administrative privilege escalation.
  • Bypasses email security gateways that categorize these files as legitimate Microsoft deployment components.
  • Evades traditional EDR alerts by utilizing trusted Microsoft binaries rather than standalone malicious executables.

• Detection & Mitigation Strategies

  • Monitor for anomalous network connections or remote manifest requests originating specifically from dfsvc.exe.
  • Audit for unusual child processes spawned by the .NET deployment framework or the ClickOnce service.
  • Implement behavioral detection to flag the execution of .appref-ms files originating from untrusted or external sources.