{"id":"060d5ad4-3153-47bb-8382-43e5e29eda92","title":"Unsigned Module Loaded by ClickOnce Application","description":"Detects unsigned module load by ClickOnce application.","author":"@SerkinValery","status":"test","level":"medium","date":"2023-06-08","modified":"","tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.stealth","attack.t1574.001"],"technique_ids":["T1574.001"],"logsource":{"category":"image_load","product":"windows"},"falsepositives":["Unlikely"],"references":["https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5"],"source_path":"rules/windows/image_load/image_load_susp_clickonce_unsigned_module_loaded.yml","source_sha256":"9ffd7f5564c689e7aaf7a7ab306cd65e970da211fd2a778e240183e4347c11f6","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_susp_clickonce_unsigned_module_loaded.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Unsigned Module Loaded by ClickOnce Application\nid: 060d5ad4-3153-47bb-8382-43e5e29eda92\nstatus: test\ndescription: Detects unsigned module load by ClickOnce application.\nreferences:\n    - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5\nauthor: '@SerkinValery'\ndate: 2023-06-08\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.execution\n    - attack.stealth\n    - attack.t1574.001\nlogsource:\n    category: image_load\n    product: windows\ndetection:\n    selection_path:\n        Image|contains: '\\AppData\\Local\\Apps\\2.0\\'\n    selection_sig_status:\n        - Signed: 'false'\n        - SignatureStatus: 'Expired'\n    condition: all of selection_*\nfalsepositives:\n    - Unlikely\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1574.001","id":"T1574.001","name":"DLL","page":"techniques/enterprise/T1574.001/"}],"data_path":"data/detection-rules/060d5ad4-3153-47bb-8382-43e5e29eda92.json","kind":"sigma"}