ClickOnce Certificate Trust Bootstrap

What it does

A signed PE installs its own Authenticode publisher certificate into the Windows TrustedPublisher store, then uses the SPC_SP_OPUS_INFO_OBJID (1.3.6.1.4.1.311.4.1.1) attribute inside that signature to retrieve a ClickOnce .application deployment URL. It loads dfshim.dll and calls ShOpenVerbApplicationW to silently install and launch the remote application. Because the certificate is now trusted, the ClickOnce trust prompt is suppressed.

Detection / fingerprint

• PE imports CRYPT32.dll + CertOpenSystemStoreA, CryptQueryObject, CertAddCertificateContextToStore, CertFindAttribute
• String literal "TrustedPublisher" in .rdata
• String literal "1.3.6.1.4.1.311.4.1.1" (SPC_SP_OPUS_INFO_OBJID)
• Loads dfshim.dll and resolves ShOpenVerbApplicationW at runtime
• No Winsock/WinInet imports — all network delegated to ClickOnce runtime
• Often signed with a stolen or compromised legitimate software vendor certificate

Reproduce on your own VMs

See the "How To Mess With It" section in raw/analyses/9477ccddefa6/report.md for a buildable C++ skeleton.

Defensive countermeasures

• Monitor CertOpenSystemStoreA("TrustedPublisher") followed by CertAddCertificateContextToStore in unsigned or low-reputation processes.
• Alert on dfshim.dll being loaded by processes that are not dfsvc.exe or browser ClickOnce launchers.
• Block outbound HTTPS to non-standard ports (e.g., 8041) from dfshim.exe / dfsvc.exe.

Pages where observed

• entities/connectwise.md — ConnectWise ScreenConnect abuse
• raw/analyses/81adbf9a/report.md — First observed ClickOnce bootstrapper
• raw/analyses/9477ccddefa6/report.md — Apr 2025 sibling