OneClik APT - AppDomainManager Hijacking via Specific DLL Load

João Pedro Rosa@akajhon

•updated Jun 25, 2025•5•7•81

Detects potential AppDomainManager hijacking used by the OneClik APT campaign, where legitimate .NET ClickOnce applications (ZSATray.exe, umt.exe, ied.exe) load a suspicious DLL like 'history.tlb'. This technique (T1574.014) is used to load attacker-controlled assemblies and execute malicious code.