ClickOnce and You're in - When Appref-ms Abuse is Operating as Intended

Overview: William Burke, Red Team Lead at CISA and adjunct graduate professor at Marymount University, presents research on abusing Microsoft ClickOnce technology for initial access and payload delivery. The talk details how security advancements in Windows Defender, antivirus engines, and email gateways have diminished the efficacy of traditional phishing vectors like macro-enabled Office documents and blocked OLE formats. The author demonstrates how legitimate ClickOnce .appref-ms deployment files can be weaponized to achieve reliable code execution on fully patched Windows 7 and Windows 10 systems.

Key Topics: - Evolution of phishing attack surfaces and defenses against legacy OLE file formats - ClickOnce deployment architecture: manifests, publish.htm, and .application files - Abuse of .appref-ms (Application Reference) files as unblocked OLE attachments - Post-exploitation and persistence: silent background updates without user interaction

Technical Details: Traditional initial access techniques, such as embedding PowerShell one-liners inside batch files packaged within Word or Excel Object Linking and Embedding (OLE) containers, have become largely ineffective. Modern defenses—including hardened Windows Defender definitions, commercial endpoint detection, and email scanners like Gmail—routinely detect and block these legacy delivery chains. Seeking a reliable alternative that operates seamlessly against fully patched Windows 7 and Windows 10 environments with active antivirus protections, the author investigated Microsoft's OLE blacklists to identify permitted file extensions capable of invoking system execution engines, building upon earlier research into .settingcontent-ms by Matt Nelson.

While Microsoft explicitly blocked direct execution of ClickOnce .application deployment manifests within OLE packages, the author discovered that .appref-ms (Application Reference) files remained fully permitted. Microsoft ClickOnce is designed to facilitate rapid web-based deployment of .NET applications across HTTP servers and UNC shares. A standard ClickOnce publication directory includes a landing page (publish.htm), an application manifest (.application), a generic installer (setup.exe), and supporting dependencies stored inside an Application Files directory. ClickOnce supports two deployment availability settings: "online only," which displays a "Run" prompt to the user, and "online or offline," which displays an "Install" prompt and automatically generates a local .appref-ms shortcut in the user's Start Menu.

The author demonstrates that delivering a weaponized .appref-ms file (either directly or encapsulated within permitted Office OLE containers) triggers the standard ClickOnce application launch workflow. When the target user clicks "Install" or "Run" once, ClickOnce downloads and executes the application from the remote host. Crucially, applications deployed with "online or offline" availability establish persistent auto-update connections: any subsequent application updates pushed to the remote web server—including forced update configurations—are retrieved and executed automatically by the operating system without displaying any warning dialogues or requiring further user authorization.

Key Takeaways: Defenders and system administrators must monitor and restrict the execution of ClickOnce deployment mechanisms and .appref-ms file handlers across enterprise workstations. Email security gateways and content inspection firewalls should treat incoming .appref-ms attachments and ClickOnce deployment manifests with the same high-risk restrictions applied to executable binaries. Security teams should audit application execution logs for anomalous parent-child process relationships originating from ClickOnce runtime binaries (dfshim.dll and dfsvc.exe).

(AI summary — Gemini Flash)