ClickOnce - Dfshim.dll Loaded by Unusual Process
Detects the ClickOnce shim DLL (dfshim.dll) being loaded by non-standard processes, indicating potential sideloading or execution abuse. The rule specifically excludes common legitimate processes like explorer.exe, rundll32.exe, dfsvc.exe, and presentationhost.exe from triggering an alert.
Microsoft Sentinel (KQL)
