T1127.002ExecutionStealth
ClickOnce
Adversaries may use ClickOnce applications (.appref-ms and.application files) to proxy execution of code through a trusted Windows utility. ClickOnce is a deployment that enables a user to create self-updating Windows-based.NET applications (i.e,.XBAP,.EXE, or.DLL) that install and run from a file share or web page with minimal user interaction. The application launches as a child process of…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
CVEs linked to ClickOnce
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.