Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
24 detections
Filters
Last updated
All Time
Detection languages
14
7
1
1
1
Contributors
6
6
5
3
2
Categories
14
6
5
3
2
Platforms
23
1
Products / Services
14
4
2
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
1
IDS Protocols
1
Detects execution of potentially suspicious processes ('Launcher.exe' or 'GapiUpdate.exe') originating from ClickOnce-related processes ('dfsvc.exe' or 'rundll32.exe' with 'dfshim.dll'). ClickOnce is often abused to proxy execution of malicious code, allowing adversaries to execute applications from user-writable directories without administrative privileges.
Detects execution of potentially suspicious processes ('Launcher.exe' or 'GapiUpdate.exe') originating from ClickOnce-related processes ('dfsvc.exe' or 'rundll32.exe' with 'dfshim.dll'). ClickOnce is often abused to proxy execution of malicious code, allowing adversaries to execute applications from user-writable directories without administrative privileges.
Detects execution of potentially suspicious processes ('Launcher.exe' or 'GapiUpdate.exe') originating from ClickOnce-related processes ('dfsvc.exe' or 'rundll32.exe' with 'dfshim.dll'). ClickOnce is often abused to proxy execution of malicious code, allowing adversaries to execute applications from user-writable directories without administrative privileges.
Detects execution of potentially suspicious processes ('Launcher.exe' or 'GapiUpdate.exe') originating from ClickOnce-related processes ('dfsvc.exe' or 'rundll32.exe' with 'dfshim.dll'). ClickOnce is often abused to proxy execution of malicious code, allowing adversaries to execute applications from user-writable directories without administrative privileges.
Detects execution of potentially suspicious processes ('Launcher.exe' or 'GapiUpdate.exe') originating from ClickOnce-related processes ('dfsvc.exe' or 'rundll32.exe' with 'dfshim.dll'). ClickOnce is often abused to proxy execution of malicious code, allowing adversaries to execute applications from user-writable directories without administrative privileges.
This rule detects potentially malicious use of the ClickOnce process (dfsvc.exe) by monitoring for suspicious parent processes (such as rundll32.exe or mshta.exe) spawning dfsvc.exe, or dfsvc.exe spawning unexpected child processes. ClickOnce is often abused by attackers to proxy the execution of malicious code, and these patterns are indicative of such activity.
Detects the execution of ClickOnce applications (via dfsvc.exe, rundll32.exe with dfshim.dll, or by opening .application/.appref-ms files) that are being launched from a remote web or file share source. This behavior is a common technique for proxying malicious code execution.
This rule detects potentially malicious use of the ClickOnce process (dfsvc.exe) by monitoring for suspicious parent processes (such as rundll32.exe or mshta.exe) spawning dfsvc.exe, or dfsvc.exe spawning unexpected child processes. ClickOnce is often abused by attackers to proxy the execution of malicious code, and these patterns are indicative of such activity.
This rule detects potentially malicious use of the ClickOnce process (dfsvc.exe) by monitoring for suspicious parent processes (such as rundll32.exe or mshta.exe) spawning dfsvc.exe, or dfsvc.exe spawning unexpected child processes. ClickOnce is often abused by attackers to proxy the execution of malicious code, and these patterns are indicative of such activity.
Detects the execution of ClickOnce applications (via dfsvc.exe, rundll32.exe with dfshim.dll, or by opening .application/.appref-ms files) that are being launched from a remote web or file share source. This behavior is a common technique for proxying malicious code execution.
Detects the execution of ClickOnce applications (via dfsvc.exe, rundll32.exe with dfshim.dll, or by opening .application/.appref-ms files) that are being launched from a remote web or file share source. This behavior is a common technique for proxying malicious code execution.
Detects the ClickOnce shim DLL (dfshim.dll) being loaded by non-standard processes, indicating potential sideloading or execution abuse. The rule specifically excludes common legitimate processes like explorer.exe, rundll32.exe, dfsvc.exe, and presentationhost.exe from triggering an alert.
This rule monitors for the execution of 'wusvc.exe' (a potential disguise for malicious binaries) when performed by users or on hostnames containing keywords associated with security research, sandboxing, or testing such as 'sandbox', 'malware', 'virus', or 'sample'.
Detects malicious ClickOnce application manifests for proxy code execution
Detects malicious ClickOnce application manifests for proxy code execution
This rule detects the download of a ClickOnce application manifest that contains specific content indicating it might be malicious. It looks for HTTP responses (flow:to_client,established) where the URI contains ".application" (case-insensitive) and the file data contains "asmv1:assembly" (case-insensitive). This combination suggests a ClickOnce deployment, which can be abused to deliver malware.
Detects the ClickOnce service (dfsvc.exe) DLL sideloading an unsigned DLL from the ClickOnce application cache directory. This behavior is indicative of a malicious ClickOnce deployment, a technique used for initial access and code execution as seen in 'OneClik' and 'SesameOp' campaigns.
This rule detects when a ClickOnce application loads an unsigned or expired-signature module. ClickOnce applications are typically found in the `\AppData\Local\Apps\2.0\` directory. The detection specifically looks for image load events where the image path matches this ClickOnce application directory pattern and the loaded module's signature status is either 'false' (unsigned) or 'Expired'. This behavior can be indicative of an adversary abusing ClickOnce for trusted code execution, potentially for privilege escalation, defense evasion, or persistence, by injecting or replacing modules with malicious unsigned ones.
Detects changes to the ClickOnce trust prompt registry key to enable installations from various locations, such as the Internet. This modification can allow an attacker to bypass security prompts and execute untrusted code via ClickOnce applications.
Detects potential AppDomainManager hijacking used by the OneClik APT campaign, where legitimate .NET ClickOnce applications (ZSATray.exe, umt.exe, ied.exe) load a suspicious DLL like 'history.tlb'. This technique (T1574.014) is used to load attacker-controlled assemblies and execute malicious code.
Detects an initiated network connection over uncommon ports from "dfsvc.exe". dfsvc.exe is a utility used to handle ClickOnce applications. Adversaries may abuse ClickOnce to proxy execution of malicious code, and unexpected network connections from this process, especially on non-standard ports, could indicate malicious activity.
Page 1 of 2