Unsigned Module Loaded by ClickOnce Application
This rule detects when a ClickOnce application loads an unsigned or expired-signature module. ClickOnce applications are typically found in the `\AppData\Local\Apps\2.0\` directory. The detection specifically looks for image load events where the image path matches this ClickOnce application directory pattern and the loaded module's signature status is either 'false' (unsigned) or 'Expired'. This behavior can be indicative of an adversary abusing ClickOnce for trusted code execution, potentially for privilege escalation, defense evasion, or persistence, by injecting or replacing modules with malicious unsigned ones.
Sigma
