{"id":"df68f791-ad95-447f-a271-640a0dab9cf8","title":"DNS Query Request To OneLaunch Update Service","description":"Detects DNS query requests to \"update.onelaunch.com\". This domain is associated with the OneLaunch adware application.\nWhen the OneLaunch application is installed it will attempt to get updates from this domain.\n","author":"Josh Nickels","status":"test","level":"low","date":"2024-02-26","modified":"","tags":["attack.credential-access","attack.collection","attack.t1056"],"technique_ids":["T1056"],"logsource":{"category":"dns_query","product":"windows"},"falsepositives":["Unlikely"],"references":["https://www.malwarebytes.com/blog/detections/pup-optional-onelaunch-silentcf","https://www.myantispyware.com/2020/12/14/how-to-uninstall-onelaunch-browser-removal-guide/","https://malware.guide/browser-hijacker/remove-onelaunch-virus/"],"source_path":"rules/windows/dns_query/dns_query_win_onelaunch_update_service.yml","source_sha256":"a760822ce1d7697b89b96ffa03b70ec913a6624cea8415594a2736a33920cffe","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/dns_query/dns_query_win_onelaunch_update_service.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: DNS Query Request To OneLaunch Update Service\nid: df68f791-ad95-447f-a271-640a0dab9cf8\nstatus: test\ndescription: |\n    Detects DNS query requests to \"update.onelaunch.com\". This domain is associated with the OneLaunch adware application.\n    When the OneLaunch application is installed it will attempt to get updates from this domain.\nreferences:\n    - https://www.malwarebytes.com/blog/detections/pup-optional-onelaunch-silentcf\n    - https://www.myantispyware.com/2020/12/14/how-to-uninstall-onelaunch-browser-removal-guide/\n    - https://malware.guide/browser-hijacker/remove-onelaunch-virus/\nauthor: Josh Nickels\ndate: 2024-02-26\ntags:\n    - attack.credential-access\n    - attack.collection\n    - attack.t1056\nlogsource:\n    category: dns_query\n    product: windows\ndetection:\n    selection:\n        QueryName: 'update.onelaunch.com'\n        Image|endswith: '\\OneLaunch.exe'\n    condition: selection\nfalsepositives:\n    - Unlikely\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1056","id":"T1056","name":"Input Capture","page":"techniques/enterprise/T1056/"}],"data_path":"data/detection-rules/df68f791-ad95-447f-a271-640a0dab9cf8.json","kind":"sigma"}