DNS Query Request To OneLaunch Update Service — Sigma Rule

Rule metadata and linked tags

Author: Josh Nickels. Source status: test; severity: low. Source dates: 2024-02-26 / not supplied.

{
  "category": "dns_query",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: a760822ce1d7697b89b96ffa03b70ec913a6624cea8415594a2736a33920cffe

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: DNS Query Request To OneLaunch Update Service
id: df68f791-ad95-447f-a271-640a0dab9cf8
status: test
description: |
    Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application.
    When the OneLaunch application is installed it will attempt to get updates from this domain.
references:
    - https://www.malwarebytes.com/blog/detections/pup-optional-onelaunch-silentcf
    - https://www.myantispyware.com/2020/12/14/how-to-uninstall-onelaunch-browser-removal-guide/
    - https://malware.guide/browser-hijacker/remove-onelaunch-virus/
author: Josh Nickels
date: 2024-02-26
tags:
    - attack.credential-access
    - attack.collection
    - attack.t1056
logsource:
    category: dns_query
    product: windows
detection:
    selection:
        QueryName: 'update.onelaunch.com'
        Image|endswith: '\OneLaunch.exe'
    condition: selection
falsepositives:
    - Unlikely
level: low

Original YAML and metadata in JSON

False positives

• Unlikely

Source references

• https://www.malwarebytes.com/blog/detections/pup-optional-onelaunch-silentcf
• https://www.myantispyware.com/2020/12/14/how-to-uninstall-onelaunch-browser-removal-guide/
• https://malware.guide/browser-hijacker/remove-onelaunch-virus/