ClickOnce AbUse for Trusted Code Execution
Nick Powers and Steven Flores show how Microsoft ClickOnce technology can be abused for stealthy phishing initial access, bypassing Mark-of-the-Web and AppLocker.
Summary
The Erosion of Traditional Phishing Initial Access Payloads
With Microsoft disabling Office macros by default and Mark-of-the-Web (MOTW) protections expanding, red teams need alternative initial access vectors.
Deconstructing Microsoft ClickOnce Architecture
Nick Powers and Steven Flores analyze ClickOnce, a native Windows deployment technology designed to launch smart client applications directly from web links.
Weaponizing ClickOnce for Code Execution and Persistence
The speakers demonstrate crafting benign-looking ClickOnce deployment manifests that execute arbitrary .NET binaries while evading browser and endpoint security controls.
Defending Enterprise Environments Against ClickOnce Abuse
The authors provide enterprise defenders with group policy configurations, AppLocker rules, and telemetry monitoring to block unauthorized ClickOnce execution.
Related talks
Main Stage·52 min
Cedric Owens
Cedric Owens details modern attack paths in non-Active Directory macOS environments, including Gatekeeper bypasses, cloud IdaaS targeting, and post-exploitation tradecraft.
Village Presentations·51 min
Dave Kennedy
TrustedSec founder Dave Kennedy analyzes the dominance of targeted phishing attacks, demonstrating macro weaponization, PowerShell evasion, and lateral movement.
Village Presentations·40 min
Adam Compton · Eric Gershman
Adam Compton and Eric Gershman introduce the SpeedPhishing Framework (SPF), automating target email harvesting, domain staging, and campaign deployment.