ClickOnce - Dropping Secondary Payloads in Startup (T1547.001)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•2•0•4

Detects an executing ClickOnce package dropping a secondary malicious script directly into the Startup folder.