Dfsvc on LOLBAS
Archived: 2026-04-06 00:22:16 UTC
Executes click-once-application from Url (trampoline for Dfsvc.exe, DotNet ClickOnce host)
Use case
Use binary to bypass Application whitelisting
Privileges required
User
Operating systems
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK® technique
T1127.002: ClickOnce
Tags
Execute: ClickOnce
Execute: Remote
Source: https://lolbas-project.github.io/lolbas/Binaries/Dfsvc/
https://lolbas-project.github.io/lolbas/Binaries/Dfsvc/
Page 1 of 1