ClickOnce - Dfsvc.exe Spawning Malicious Shells (T1218)
Detects the native ClickOnce service host (dfsvc.exe) spawning interactive command shells, a direct indicator of exploitation.
Microsoft Sentinel (KQL)
Detects the native ClickOnce service host (dfsvc.exe) spawning interactive command shells, a direct indicator of exploitation.
Already have an account?