ClickOnce - Renamed ClickOnce Bypassing AppLocker

Ibrahim Saud@tektrix

•updated Jun 20, 2026•3•0•10

Identifies attackers renaming the ClickOnce executable (dfsvc.exe) to bypass basic AppLocker path rules. This rule specifically looks for instances where the original file name is 'dfsvc.exe' but the current file name is different, indicating a rename.