Red Team Tactics

Abusing Microsoft ClickOnce as an Initial Access Primitive

How ClickOnce deployment flows become a low-noise payload delivery channel inside trusted Windows execution paths.

ICS Phishing: When Your Calendar Becomes the Attack Surface

How calendar invites become phishing payloads that bypass inbox controls and live inside trusted apps.