Suspicious Child Process Spawned by ClickOnce Application (Windows)
Alerts when a ClickOnce app under AppData\Local\Apps\2.0\ spawns common script/tool executables.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-12
- Updated
- 2026-07-31
What it detects
This rule flags Windows process creations where the parent process image path contains the ClickOnce deployment directory under AppData\Local\Apps\2.0\ and the spawned child process matches a list of notable executables (e.g., cmd.exe, powershell.exe, mshta.exe, regsvr32.exe, rundll32.exe). Such activity is often used to execute additional payloads or tooling from within a trusted ClickOnce-launched context. It relies on process creation telemetry that records parent and child process image paths.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
suspicious-child-process-from-clickonce-appdata-local-apps-2-0-windows-67bc0e75
title: Suspicious Child Process Spawned by ClickOnce Application (Windows)
id: 1c0f962f-7ae8-48f7-9d1b-30858130dc6c
status: test
description: This rule flags Windows process creations where the parent process image path contains the ClickOnce deployment directory under AppData\Local\Apps\2.0\ and the spawned child process matches a list of notable executables (e.g., cmd.exe, powershell.exe, mshta.exe, regsvr32.exe, rundll32.exe). Such activity is often used to execute additional payloads or tooling from within a trusted ClickOnce-launched context. It relies on process creation telemetry that records parent and child process image paths.
references:
- https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dfsvc_suspicious_child_processes.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-12
tags:
- attack.execution
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains: \AppData\Local\Apps\2.0\
Image|endswith:
- \calc.exe
- \cmd.exe
- \cscript.exe
- \explorer.exe
- \mshta.exe
- \net.exe
- \net1.exe
- \nltest.exe
- \notepad.exe
- \powershell.exe
- \pwsh.exe
- \reg.exe
- \regsvr32.exe
- \rundll32.exe
- \schtasks.exe
- \werfault.exe
- \wscript.exe
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 67bc0e75-c0a9-4cfc-8754-84a505b63c04
type: derived