ClickOnce Abused for Persistent Threat Actor Access (Part 2)

Sat, 11 Jul 2026 11:49:48 +0000

Engineer — Learn: Describes how attackers abuse the ClickOnce deployment mechanism for persistence in Windows environments — no patch or config change indicated, but worth understanding if you deploy .NET apps or manage Windows estates.
SOC/IR — Plan: New ClickOnce-based persistence TTP with public CrowdStrike analysis — build or tune detections around ClickOnce application installations and associated scheduled tasks or registry run keys in your SIEM/EDR.
Leader — Skip

Persistence on CuraSec