CmdID / Techniques / T1127

T1127.002 Trusted Developer Utilities Proxy Execution: ClickOnce

Adversaries may use ClickOnce applications (.appref-ms and .application files) to proxy execution of code through a trusted Windows utility. MITRE ATT&CK

4 programs on CmdID T1127.002 on attack.mitre.org

Part of

MITRE ATT&CK

T1127Trusted Developer Utilities Proxy Execution

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

applaunch.exeAWL Bypass dfshim.dllAWL Bypass dfsvc.exeAWL Bypass rundll32.exeAWL Bypass