ClickOnce - Appref-ms Shortcut Execution

Ibrahim Saud@tektrix

•updated Jun 20, 2026•1•0•6

Detects the execution of ClickOnce application reference shortcuts (.appref-ms) which point to malicious remote URIs. This rule specifically looks for process command lines containing '.appref-ms' and initiated by 'explorer.exe'.