ClickOnce - Dfsvc.exe creating persistence (T1547.001)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•3•0•4

Detects the ClickOnce handler itself creating Run/RunOnce registry persistence mechanisms.