Detection rules › Elastic
Execution via Microsoft DotNet ClickOnce Host
Identifies the execution of DotNet ClickOnce installer via Dfsvc.exe trampoline. Adversaries may take advantage of ClickOnce to proxy execution of malicious payloads via trusted Microsoft processes.
MITRE ATT&CK coverage
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 3 | Network connection |
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body elastic
[metadata]
creation_date = "2023/09/25"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"
[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
Identifies the execution of DotNet ClickOnce installer via Dfsvc.exe trampoline. Adversaries may take advantage of
ClickOnce to proxy execution of malicious payloads via trusted Microsoft processes.
"""
from = "now-119m"
index = ["logs-endpoint.events.*"]
interval = "60m"
language = "eql"
license = "Elastic License v2"
name = "Execution via Microsoft DotNet ClickOnce Host"
risk_score = 21
rule_id = "5297b7f1-bccd-4611-93fa-ea342a01ff84"
severity = "low"
tags = [
"Domain: Endpoint",
"OS: Windows",
"Use Case: Threat Detection",
"Tactic: Defense Evasion",
"Rule Type: BBR",
"Data Source: Elastic Defend",
]
type = "eql"
query = '''
sequence by user.id with maxspan=5s
[process where host.os.type == "windows" and event.action == "start" and
process.name : "rundll32.exe" and process.command_line : ("*dfshim*ShOpenVerbApplication*", "*dfshim*#*")]
[network where host.os.type == "windows" and process.name : "dfsvc.exe"]
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1127"
name = "Trusted Developer Utilities Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1127/"
[[rule.threat.technique.subtechnique]]
id = "T1127.002"
name = "ClickOnce"
reference = "https://attack.mitre.org/techniques/T1127/002/"
[[rule.threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[rule.threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"
[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
Stages and Predicates
Ordered sequence: each step below must occur in order within 5s, correlated by user.id.
Stage 1: process
[process where host.os.type == "windows" and event.action == "start" and
process.name : "rundll32.exe" and process.command_line : ("*dfshim*ShOpenVerbApplication*", "*dfshim*#*")]
Stage 2: network
[network where host.os.type == "windows" and process.name : "dfsvc.exe"]
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
event.action | eq |
|
process.command_line | wildcard |
|
process.name | wildcard |
|