ClickOnce Deployment Execution - Dfsvc.EXE Child Process

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•42

Detects child processes of 'dfsvc.exe' that are launched from the 'AppData\Local\Apps\2.0\' directory, which is indicative of a ClickOnce deployment execution. This rule aims to identify potentially malicious or unexpected ClickOnce application launches.