ClickOnce - HTTP Application Deployment (T1105)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•1•0•8

Tracks network communication matching specific ClickOnce deployment URLs traversing over unencrypted HTTP. This rule identifies attempts to download or access ClickOnce application deployment files (.application) over unencrypted HTTP, which could indicate a potential supply chain attack or malware delivery mechanism.