DNS Query Request To OneLaunch Update Service

Title: DNS Query Request To OneLaunch Update Service
Status: test
Description:Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. When the OneLaunch application is installed it will attempt to get updates from this domain.
References:
  -https://www.malwarebytes.com/blog/detections/pup-optional-onelaunch-silentcf
  -https://www.myantispyware.com/2020/12/14/how-to-uninstall-onelaunch-browser-removal-guide/
  -https://malware.guide/browser-hijacker/remove-onelaunch-virus/
Author: Josh Nickels
Date: 2024-02-26
modified:None
Tags:

• -'attack.credential-access'
• -'attack.collection'
• -'attack.t1056'

Logsource:

• category: dns_query
• product: windows

Detection:
  selection:
    QueryName: 'update.onelaunch.com'
    Image|endswith: '\OneLaunch.exe'
  condition:selection
Falsepositives:
  -Unlikely
Level: low