Detectionlowtest

DNS Query Request To OneLaunch Update Service

Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. When the OneLaunch application is installed it will attempt to get updates from this domain.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Josh NickelsCreated Mon Feb 26df68f791-ad95-447f-a271-640a0dab9cf8windows

Log Source

WindowsDNS Query

ProductWindows← raw: windows

CategoryDNS Query← raw: dns_query

DNS lookup events generated by endpoint monitoring tools.

Detection Logic

detection:
    selection:
        QueryName: 'update.onelaunch.com'
        Image|endswith: '\OneLaunch.exe'
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

MITRE ATT&CK

Tactics

TA0006 · Credential Access TA0009 · Collection

Techniques

T1056 · Input Capture

Rule Metadata

Rule ID

df68f791-ad95-447f-a271-640a0dab9cf8

Status

test

Level

low

Type

Detection

Created

Mon Feb 26

Author

Josh Nickels

Path

rules/windows/dns_query/dns_query_win_onelaunch_update_service.yml

Raw Tags

attack.credential-accessattack.collectionattack.t1056

View on GitHub