Unsigned Module Loaded by ClickOnce Application

Title: Unsigned Module Loaded by ClickOnce Application
Status: test
Description:Detects unsigned module load by ClickOnce application.
References:
  -https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
Author: @SerkinValery
Date: 2023-06-08
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1574.001'

Logsource:

• category: image_load
• product: windows

Detection:
  selection_path:
    Image|contains: '\AppData\Local\Apps\2.0\'
  selection_sig_status:
Signed:'false' SignatureStatus:'Expired'   condition:all of selection_*
Falsepositives:
  -Unlikely
Level: medium