ClickOnce - Privilege Escalation via Consent (T1548.002)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•2•0•9

Detects the ClickOnce payload attempting to spawn the UAC consent.exe dialogue to elevate its privileges post-install.