Windows ClickOnce Loads Unsigned Module from AppData\Local\Apps\2.0

title: Windows ClickOnce Loads Unsigned Module from AppData\Local\Apps\2.0
id: 918c99cc-bb2c-4ca5-bcd3-5d6a63089d54
status: test
description: This rule flags ClickOnce-related image loads from the local ClickOnce app directory path when the loaded module is not signed or has an expired signature status. Attackers may abuse ClickOnce-associated execution to introduce or run untrusted components, bypassing trust expectations. The detection relies on Windows image load telemetry that includes the image path and signature/signing status indicators.
references:
  - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_susp_clickonce_unsigned_module_loaded.yml
author: "@SerkinValery, Huntrule Team"
date: 2023-06-08
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection_path:
    Image|contains: \AppData\Local\Apps\2.0\
  selection_sig_status:
    - Signed: "false"
    - SignatureStatus: Expired
  condition: all of selection_*
falsepositives:
  - Unlikely
level: medium
license: DRL-1.1
related:
  - id: 060d5ad4-3153-47bb-8382-43e5e29eda92
    type: derived