ClickOnce - Auto-Update Network Beacon (T1072)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•2•0•5

Monitors dfsvc.exe making outbound connections to non-standard, external URLs, representing malicious auto-update polling.