ClickOnce and You're in - When Appref-ms Abuse is Operating as Intended

Explore the intricacies of .appref-ms files and their potential for malicious exploitation in this 25-minute Black Hat conference talk. Dive deep into the functionality and operation of these files, uncovering methods to leverage them for nefarious purposes. Gain insight into the user experience during execution and learn additional techniques to enhance and conceal malicious capabilities. Examine topics such as ClickOnce technology, application deployment, lateral movement, and command and control management, complete with a live demonstration. Walk away with three key takeaways to better understand and defend against this potential security threat.

Intro
Speaker Introduction
The End of the Golden Age
A New Light Arises
A ClickOnce Summary
Application Deployment
Lateral Movement Rundown
C2 Management - Demo
3 Takeaways