Windows ClickOnce Execution: dfsvc.exe Child Process Launch
Flags ClickOnce-style child processes spawned by dfsvc.exe from the AppData\Local\Apps\2.0\ directory on Windows.
FreeReviewedSigma · Medium · v5
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-12
- Updated
- 2026-07-31
What it detects
This rule identifies process creation events where the parent process is dfsvc.exe and the child process path matches the ClickOnce application directory under %AppData%\Local\Apps\2.0\ . Attackers may abuse ClickOnce deployment execution to run trusted-looking payloads from the user profile, making parent-child process relationships a useful signal. It relies on Windows process creation telemetry with parent and image path fields.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-clickonce-deployment-execution-via-dfsvc-exe-child-process-241d52b5
title: "Windows ClickOnce Execution: dfsvc.exe Child Process Launch"
id: b1f887be-7e25-4388-90a9-c674344519c1
status: test
description: This rule identifies process creation events where the parent process is dfsvc.exe and the child process path matches the ClickOnce application directory under %AppData%\Local\Apps\2.0\ . Attackers may abuse ClickOnce deployment execution to run trusted-looking payloads from the user profile, making parent-child process relationships a useful signal. It relies on Windows process creation telemetry with parent and image path fields.
references:
- https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_dfsvc_child_processes.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-12
tags:
- attack.execution
- detection.threat-hunting
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \dfsvc.exe
Image|endswith: \AppData\Local\Apps\2.0\
condition: selection
falsepositives:
- False positives are expected in environement leveraging ClickOnce deployments. An initial baselining is required before using this rule in production.
level: medium
license: DRL-1.1
related:
- id: 241d52b5-eee0-49d0-ac8a-8b9c15c7221c
type: derived