Malicious ClickOnce Application Manifest Download

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•7

This rule detects the download of a ClickOnce application manifest that contains specific content indicating it might be malicious. It looks for HTTP responses (flow:to_client,established) where the URI contains ".application" (case-insensitive) and the file data contains "asmv1:assembly" (case-insensitive). This combination suggests a ClickOnce deployment, which can be abused to deliver malware.