ClickOnce - Code Signing Certificate Abuse (T1553.002)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•4•0•13

Hunts for newly installed applications in the ClickOnce directory cache signed by self-signed or explicitly untrusted certificates, specifically looking for process creation events where the initiating process is 'dfsvc.exe' and the signature is marked as 'Untrusted'.