DNS Query Request To OneLaunch Update Service

Status: test
Severity: low
Log source: category dns_query, product windows
Author: Josh Nickels
Source: github.com/SigmaHQ/sigma

Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. When the OneLaunch application is installed it will attempt to get updates from this domain.

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1056` Input Capture
Collection	`T1056` Input Capture

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 22: DNSEvent (DNS query)

Rule body

title: DNS Query Request To OneLaunch Update Service
id: df68f791-ad95-447f-a271-640a0dab9cf8
status: test
description: |
    Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application.
    When the OneLaunch application is installed it will attempt to get updates from this domain.
references:
    - https://www.malwarebytes.com/blog/detections/pup-optional-onelaunch-silentcf
    - https://www.myantispyware.com/2020/12/14/how-to-uninstall-onelaunch-browser-removal-guide/
    - https://malware.guide/browser-hijacker/remove-onelaunch-virus/
author: Josh Nickels
date: 2024-02-26
tags:
    - attack.credential-access
    - attack.collection
    - attack.t1056
logsource:
    category: dns_query
    product: windows
detection:
    selection:
        QueryName: 'update.onelaunch.com'
        Image|endswith: '\OneLaunch.exe'
    condition: selection
falsepositives:
    - Unlikely
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    QueryName: 'update.onelaunch.com'
    Image|endswith: '\OneLaunch.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\OneLaunch.exe`	`field:"Image" kind:ends_with value:"\OneLaunch.exe"`
`QueryName`	eq	`update.onelaunch.com`	`field:"QueryName" kind:eq value:"update.onelaunch.com"`