ClickOnce deployment invoked or abused via rundll32 or dfsvc

Siemphony@siemphonylowT1127.002unverified

Covers the process_creation half of AN0550. The first leg matches the exact command line every ClickOnce launch uses under the hood: rundll32.exe invoking dfshim.dll's ShOpenVerbApplication export, which is how Windows opens an .appref-ms or .application file whether the user double-clicked a legitimate internal line-of-business tool or a malicious lookalike — the command line itself cannot tell the two apart, which is exactly why MITRE's KnownClickOnceApps knob exists. The second leg flags dfsvc.exe, the ClickOnce host service, spawning a process type it has no legitimate reason to spawn; SuspiciousChildList is MITRE's knob, populated here with general-purpose interpreters and LOLBIN staples rather than the deployed application itself. AN0550's other leg — dfsvc.exe loading an unsigned module, observed on Sysmon EventID 7 (image_load) — is a separate event with no join available in lib/sigma and is not attempted here. The brief also maps this analytic onto Security 4688; this rule is written in the Sysmon process_creation vocabulary (Image, ParentImage, CommandLine), so a 4688-only feed needs NewProcessName mapped to Image and ParentProcessName mapped to ParentImage, plus Audit Process Creation and the separate command-line auditing policy enabled, or it returns nothing. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0191, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\rundll32.exe" and ProcessCommandLine contains "dfshim" and ProcessCommandLine contains "ShOpenVerbApplication") or (InitiatingProcessFolderPath endswith "\\dfsvc.exe" and (FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\rundll32.exe" or FolderPath endswith "\\regsvr32.exe" or FolderPath endswith "\\certutil.exe" or FolderPath endswith "\\bitsadmin.exe")))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\rundll32.exe" AND CommandLine="*dfshim*" AND CommandLine="*ShOpenVerbApplication*") OR (ParentImage="*\\dfsvc.exe" AND (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe" AND TO_LOWER(process.command_line) LIKE "*dfshim*" AND TO_LOWER(process.command_line) LIKE "*shopenverbapplication*") OR (TO_LOWER(process.parent.executable) LIKE "*\\\\dfsvc.exe" AND (TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" OR TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\regsvr32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\certutil.exe" OR TO_LOWER(process.executable) LIKE "*\\\\bitsadmin.exe")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\rundll32\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)dfshim</field>    <field name="CommandLine" type="pcre2">(?i)ShOpenVerbApplication</field>    <description>ClickOnce deployment invoked or abused via rundll32 or dfsvc (1/2)</description>    <mitre>      <id>T1127.002</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)\\dfsvc\.exe$</field>    <field name="Image" type="pcre2">(?i)(\\cmd\.exe$|\\powershell\.exe$|\\pwsh\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$|\\certutil\.exe$|\\bitsadmin\.exe$)</field>    <description>ClickOnce deployment invoked or abused via rundll32 or dfsvc (2/2)</description>    <mitre>      <id>T1127.002</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: signed_binary_proxy
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: a70bc0ed-2f90-44cb-a041-6f75be56bc5e

ATT&CKT1127.002

T1127.002ClickOnce

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonsigned binary proxy

signed binary proxyAI draft — unreviewed

01 · What this rule detects

MITRE's AN1550 (analytic 0550 — note the numbering typo is ours to avoid, the ID is AN0550) describes two things: rundll32.exe invoking dfshim.dll's ShOpenVerbApplication export, and dfsvc.exe — the ClickOnce host service — spawning or loading something unexpected. This rule implements only the process_creation half, as two independent selections joined with 1 of selection*: selection_dfshim matches the exact launch command line every .appref-ms/.application open produces, and selection_dfsvc_child matches dfsvc.exe spawning one of ten interpreter/LOLBIN binaries. Either one alone fires the rule — there is no requirement that both happen together.

02 · Telemetry you need

Sysmon EventID 1 (process_creation), with Image, ParentImage and CommandLine populated. The brief also maps AN0550 onto Security 4688, but this rule is written in Sysmon's field vocabulary — a 4688-only feed needs NewProcessName mapped to Image and ParentProcessName mapped to ParentImage, plus Audit Process Creation and the separate command-line auditing policy turned on, neither of which is default. AN0550's third leg — dfsvc.exe loading an unsigned module on Sysmon EventID 7 — needs a cross-event join lib/sigma doesn't support and isn't attempted here.

03 · How the logic works

selection_dfshim requires Image ending in \rundll32.exe and CommandLine containing both dfshim and ShOpenVerbApplication. The review flagged that the windash modifier attached to ShOpenVerbApplication is a no-op — windash normalizes -flag//flag variants, and this is a bare export-name substring with no dash prefix — harmless but worth knowing it does nothing. selection_dfsvc_child requires ParentImage ending in \dfsvc.exe and Image ending in one of ten binaries (cmd, powershell, pwsh, wscript, cscript, mshta, rundll32, regsvr32, certutil, bitsadmin). This list is the pipeline's own population of MITRE's SuspiciousChildList knob, not MITRE's values — MITRE names the knob, not the contents. The review also noted the rundll32 entry here is speculative: in the documented ClickOnce chain, rundll32 is normally dfsvc's parent, not its child, so that one line lacks a cited path where dfsvc shells back out to it.

04 · Common false positives

Every legitimately signed ClickOnce application — an internal LOB tool, a vendor deployment — produces the exact selection_dfshim command line on every ordinary launch. This is not an edge case; it is the normal Windows mechanism for opening .appref-ms/.application files, so the rule fires on all of them until MITRE's KnownClickOnceApps allowlist knob is populated for your estate. On the selection_dfsvc_child side, ClickOnce prerequisite installs (dfsvc shelling to msiexec or a bundled setup binary) and legitimate app self-repair or update logic calling cmd.exe or powershell.exe both look identical to malicious use of dfsvc as a trusted parent.

05 · Detection maturity

tier_1: This rule has never been run against a log line. It sits at the lowest DeBMM tier — authored-but-unverified — until it has been deployed against real telemetry, its false-positive volume measured, and KnownClickOnceApps populated for a specific estate.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Populate KnownClickOnceApps with the paths or hashes of every ClickOnce deployment actually running in the environment and exclude their launch command lines — this is the single highest-leverage tuning step, since without it the rule is closer to an inventory of ClickOnce usage than an anomaly detector. On selection_dfsvc_child, consider dropping or separately flagging the rundll32 entry given the review's lineage concern, and watch for prerequisite-install noise from msiexec chains launched under dfsvc.exe.

Declared by the author

Every ordinary ClickOnce launch of a legitimately signed internal or vendor .NET application from a Start Menu shortcut, a file association, or a web page — this rundll32/dfshim/ShOpenVerbApplication command line is the normal, documented mechanism Windows uses to open .appref-ms and .application files, not an anomaly, so any actively deployed ClickOnce app will match this rule on every use until MITRE's KnownClickOnceApps allowlist is populated for the estate.
ClickOnce prerequisite installation, where dfsvc.exe legitimately shells out to msiexec.exe or a bundled setup executable to install a missing .NET runtime or dependency before the deployed application can run, which selection_dfsvc_child's certutil/bitsadmin/script-host entries do not exclude if the prerequisite package happens to invoke one of them.
Update or self-repair logic in a deployed ClickOnce application that legitimately calls cmd.exe or powershell.exe as a post-install step, which is indistinguishable at the process_creation level from a malicious payload using dfsvc.exe as a trusted parent.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1127.002, evaluated against their process_creation events.

Share this rule

/u/siemphony/a70bc0ed-2f90-44cb-a041-6f75be56bc5e

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

ClickOnce deployment invoked or abused via rundll32 or dfsvc

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it