ClickOnce - Auto-Update Loop to Raw IP (T1072)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•1•0•5

Identifies dfsvc.exe bypassing DNS to check for manifest updates directly from raw external IP addresses. This behavior can indicate an attempt to evade network monitoring or connect to a hardcoded malicious update server.