Security researchers at CrowdStrike have detailed how attackers are abusing ClickOnce, a low profile Microsoft technology for installing and updating Windows applications, to deliver malware and quietly maintain a foothold on victim machines. In a two part study, CrowdStrike's Mathilde Venault documents the inner workings of the technology and reveals what the team believes is a previously undisclosed way of weaponizing it.
ClickOnce lets developers package an application so a user can install and automatically update it with little more than a click, and without needing administrator rights. That convenience is exactly what makes it attractive to attackers. To get their malware running, they only need to convince a target to click once or twice, and the delivery often slips past defenses that focus on traditional executables.
Why attackers like it
CrowdStrike highlights a few reasons ClickOnce is appealing for the early, delivery stage of an attack. ClickOnce apps can be launched from small .application files, which many organizations scrutinize far less closely than .exe files, so a malicious launcher can fly under the radar of mailbox filters and application controls. The low level of awareness around the technology helps too: because ClickOnce installs run through trusted, built in Windows components rather than an obviously suspicious binary, the activity can blend into normal system behavior. The result is a delivery method that needs minimal user interaction and sidesteps several common protections at once.
The researchers say they also uncovered a new abuse of the technology, beyond the weaponization techniques already known, that security teams should be aware of, and they outline how it can be used both to execute a payload and to persist on a system. CrowdStrike has presented the work publicly and demonstrated how its own sensor detects the activity.
What you should do
Treat .application files with the same caution as executables: filter them at the mail gateway and flag them when they arrive from outside the organization. Hunt for ClickOnce activity in your telemetry, particularly the built in deployment components dfsvc.exe and dfshim.dll spawning unexpected child processes or reaching out to unfamiliar domains. Where ClickOnce is not a business requirement, consider restricting or disabling it through application control policies, and remind users that an install prompt arriving by email or web link deserves the same suspicion as any unexpected attachment. CrowdStrike's full analysis is available in its research write up. The technique sits alongside other low friction delivery tricks we have covered, such as malware that uses fake fix it prompts to gain a foothold and poisoned downloads pushed through compromised websites.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.