T1127.002sub-technique of T1127 Trusted Developer Utilities Proxy Execution
ClickOnce
Windowsnothing on this site yetT1127.002 on attack.mitre.org
Adversaries may use ClickOnce applications (.appref-ms and.application files) to proxy execution of code through a trusted Windows utility. ClickOnce is a deployment that enables a user to create self-updating Windows-based.NET applications (i.e,.XBAP,.EXE, or.DLL) that install and run from a file share or web page with minimal user interaction.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
how MITRE says to see it
Behavior-chain detection strategy for T1127.002 Trusted Developer Utilities Proxy Execution: ClickOnce (Windows)
- Abuse of ClickOnce applications where rundll32.exe invokes dfshim.dll with ShOpenVerbApplication or dfsvc.exe spawns unexpected child processes or loads unsigned modules.
what reduces it
- M1021 Restrict Web-Based Content. Disable ClickOnce installations from the internet using the following registry key: `\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Security\TrustManager\PromptingLevel , Internet:Disabled`
- M1045 Code Signing. Enforce binary and application integrity with digital signature verification to prevent untrusted code from executing.
- M1042 Disable or Remove Feature or Program. Disable ClickOnce installations from the internet using the following registry key: `\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Security\TrustManager\PromptingLevel , Internet:Disabled` ClickOnce may not be necessary within an environment and should be disabled if not being used.