Windows ClickOnce Execution: dfsvc.exe Child Process Launch

title: "Windows ClickOnce Execution: dfsvc.exe Child Process Launch"
id: b1f887be-7e25-4388-90a9-c674344519c1
status: test
description: This rule identifies process creation events where the parent process is dfsvc.exe and the child process path matches the ClickOnce application directory under %AppData%\Local\Apps\2.0\ . Attackers may abuse ClickOnce deployment execution to run trusted-looking payloads from the user profile, making parent-child process relationships a useful signal. It relies on Windows process creation telemetry with parent and image path fields.
references:
  - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_dfsvc_child_processes.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-12
tags:
  - attack.execution
  - detection.threat-hunting
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \dfsvc.exe
    Image|endswith: \AppData\Local\Apps\2.0\
  condition: selection
falsepositives:
  - False positives are expected in environement leveraging ClickOnce deployments. An initial baselining is required before using this rule in production.
level: medium
license: DRL-1.1
related:
  - id: 241d52b5-eee0-49d0-ac8a-8b9c15c7221c
    type: derived