Detecting and Mitigating ClickOnce Proxy Execution (T1127.002)

ClickOnce is a Microsoft deployment feature for self-updating .NET apps. A user opens a link or a file, a prompt appears, and the app installs and runs from a web page or file share. MITRE tracks abuse of it as T1127.002, a sub-technique of Trusted Developer Utilities Proxy Execution. It sits under the stealth and execution tactics and applies to Windows.

The appeal is simple. ClickOnce apps get limited permissions, so installing one does not need administrator rights. The code runs through a trusted Windows component instead of a binary the attacker dropped.

How attackers use it

MITRE describes a few routes. The app launches as a child process of DFSVC.EXE, the service that installs, launches and updates ClickOnce apps. So the malicious code inherits some of that trusted standing.

• User execution. A user visits a malicious site, sees a ClickOnce install prompt, and the .NET malware is disguised as legitimate software.
• Rundll32. The command rundll32.exe dfshim.dll,ShOpenVerbApplication1 can be used to start a ClickOnce app.
• Persistence. The ClickOnce application file can be placed in a remote user's startup folder so it runs again later.

Because no privilege escalation is needed, the technique fits an intrusion that begins with a single click from an ordinary user.

How to detect it

The MITRE page lists one behavior chain for Windows. Watch for:

• rundll32.exe invoking dfshim.dll with ShOpenVerbApplication.
• dfsvc.exe spawning child processes you do not expect.
• dfsvc.exe loading unsigned modules.

In practice that means process creation logs with parent and command line (Security event 4688 with command line auditing on, or Sysmon event ID 1) and module load telemetry (Sysmon event ID 7). Alert on rundll32 command lines that mention dfshim, and baseline which ClickOnce apps your organization really uses so new ones stand out.

How to reduce the risk

MITRE lists three mitigations.

1. Disable the feature if you do not use it. ClickOnce may not be necessary in your environment.
2. Block internet installs. Set the TrustManager prompting level for the Internet zone to disabled using this registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Security\TrustManager\PromptingLevel, with the value Internet set to Disabled.
3. Enforce code signing. Require digital signature verification so untrusted code does not run.

Check your own environment

Read-only checks on Windows:

reg query "HKLM\SOFTWARE\Microsoft\.NETFramework\Security\TrustManager\PromptingLevel"

Get-ChildItem "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup" -Force

The first shows whether internet installs are disabled. The second lists the current user's startup folder, where an unexpected .appref-ms file deserves a look.

Quick check

Sources

• MITRE ATT&CK, T1127.002 ClickOnce