ClickOnce Trust Prompt Registry Tampering

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•33

Detects changes to the ClickOnce trust prompt registry key to enable installations from various locations, such as the Internet. This modification can allow an attacker to bypass security prompts and execute untrusted code via ClickOnce applications.