Suspicious Child Process from ClickOnce AppData\Local\Apps\2.0\ (Windows)

title: Suspicious Child Process from ClickOnce AppData\Local\Apps\2.0\ (Windows)
id: 1c0f962f-7ae8-48f7-9d1b-30858130dc6c
status: test
description: This rule flags process creation where the parent process path indicates a ClickOnce deployment under AppData\Local\Apps\2.0\ and the new process is one of several scripting or system binaries. Such parent-child execution patterns can indicate an attacker leveraging ClickOnce-installed content to launch follow-on payloads. Telemetry required is Windows process creation events containing the parent image path and the child image filename.
references:
  - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dfsvc_suspicious_child_processes.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-12
tags:
  - attack.execution
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains: \AppData\Local\Apps\2.0\
    Image|endswith:
      - \calc.exe
      - \cmd.exe
      - \cscript.exe
      - \explorer.exe
      - \mshta.exe
      - \net.exe
      - \net1.exe
      - \nltest.exe
      - \notepad.exe
      - \powershell.exe
      - \pwsh.exe
      - \reg.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \schtasks.exe
      - \werfault.exe
      - \wscript.exe
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 67bc0e75-c0a9-4cfc-8754-84a505b63c04
    type: derived