https://peertube.eqver.se/videos/watch/04042313-24c8-44d4-a7f1-51f51ca12d23 A DEF CON 30 talk exploring ClickOnce as an underused yet powerful initial access technique. The speakers demonstrate how this deployment technology can be leveraged to bypass Windows defenses such as SmartScreen, application whitelisting, and other security controls. The presentation focuses on turning ClickOnce into an effective initial access vector without relying on expensive EV code-signing certificates. As traditional phishing techniques (including Office macros) face increasing restrictions, the speakers show how attackers can abuse trust in signed .NET assemblies to evade security mechanisms. Two core techniques are demonstrated: sideloading existing signed ClickOnce deployments, and creating custom ClickOnce manifests around trusted .NET applications The talk dives deep into manifest structures, integrity validation mechanisms, UAC nuances, and practical exploitation workflows — including live demonstrations. Finally, the speakers introduce automation tools, discuss detection opportunities, and outline defensive strategies. A hands-on exploration of both offensive and defensive tradecraft around a little-known but highly capable Windows execution mechanism. Fri, 24 Jul 2026 11:46:31 GMT https://validator.w3.org/feed/docs/rss2.html PeerTube - https://peertube.eqver.se https://peertube.eqver.se/client/assets/images/icons/icon-512x512.png https://peertube.eqver.se/videos/watch/04042313-24c8-44d4-a7f1-51f51ca12d23 All rights reserved, unless otherwise specified in the terms specified at https://peertube.eqver.se/about and potential licenses granted by each content's rightholder.