ClickOnce deployment invoked or abused via rundll32 or dfsvc

1title: ClickOnce deployment invoked or abused via rundll32 or dfsvc2id: a70bc0ed-2f90-44cb-a041-6f75be56bc5e3status: experimental4description: |5  Covers the process_creation half of AN0550. The first leg matches the exact6  command line every ClickOnce launch uses under the hood: rundll32.exe7  invoking dfshim.dll's ShOpenVerbApplication export, which is how Windows8  opens an .appref-ms or .application file whether the user double-clicked a9  legitimate internal line-of-business tool or a malicious lookalike — the10  command line itself cannot tell the two apart, which is exactly why MITRE's11  KnownClickOnceApps knob exists. The second leg flags dfsvc.exe, the ClickOnce12  host service, spawning a process type it has no legitimate reason to spawn;13  SuspiciousChildList is MITRE's knob, populated here with general-purpose14  interpreters and LOLBIN staples rather than the deployed application itself.15  AN0550's other leg — dfsvc.exe loading an unsigned module, observed on Sysmon16  EventID 7 (image_load) — is a separate event with no join available in17  lib/sigma and is not attempted here. The brief also maps this analytic onto18  Security 4688; this rule is written in the Sysmon process_creation vocabulary19  (Image, ParentImage, CommandLine), so a 4688-only feed needs NewProcessName20  mapped to Image and ParentProcessName mapped to ParentImage, plus Audit21  Process Creation and the separate command-line auditing policy enabled, or it22  returns nothing.23  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0191, not hand-written and not tested by its author. Any lab result is on this rule's own page.24references:25  - https://attack.mitre.org/techniques/T1127/00226  - https://attack.mitre.org/detectionstrategies/DET019127author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)28date: 2026-08-1729tags:30  - attack.defense-evasion31  - attack.execution32  - attack.t1127.00233logsource:34  category: process_creation35  product: windows36detection:37  selection_dfshim:38    Image|endswith: '\rundll32.exe'39    CommandLine|contains:40      - 'dfshim'41    CommandLine|contains|windash:42      - 'ShOpenVerbApplication'43  selection_dfsvc_child:44    ParentImage|endswith: '\dfsvc.exe'45    Image|endswith:46      - '\cmd.exe'47      - '\powershell.exe'48      - '\pwsh.exe'49      - '\wscript.exe'50      - '\cscript.exe'51      - '\mshta.exe'52      - '\rundll32.exe'53      - '\regsvr32.exe'54      - '\certutil.exe'55      - '\bitsadmin.exe'56  condition: 1 of selection*57falsepositives:58  - "Every ordinary ClickOnce launch of a legitimately signed internal or vendor .NET application from a Start Menu shortcut, a file association, or a web page — this rundll32/dfshim/ShOpenVerbApplication command line is the normal, documented mechanism Windows uses to open .appref-ms and .application files, not an anomaly, so any actively deployed ClickOnce app will match this rule on every use until MITRE's KnownClickOnceApps allowlist is populated for the estate."59  - "ClickOnce prerequisite installation, where dfsvc.exe legitimately shells out to msiexec.exe or a bundled setup executable to install a missing .NET runtime or dependency before the deployed application can run, which selection_dfsvc_child's certutil/bitsadmin/script-host entries do not exclude if the prerequisite package happens to invoke one of them."60  - "Update or self-repair logic in a deployed ClickOnce application that legitimately calls cmd.exe or powershell.exe as a post-install step, which is indistinguishable at the process_creation level from a malicious payload using dfsvc.exe as a trusted parent."61level: low