ClickOnce - Silent Maintenance UI Invocation (T1218.011)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•1•0•5

Identifies rundll32.exe executing dfshim.dll,ShArpMaintain silently to uninstall or modify ClickOnce applications from the command line. This activity can be abused by attackers to install, persist, and update malware without administrative privileges.