Possible DNS Query Request To OneLaunch Update Service (via dns_query)

title: Possible DNS Query Request To OneLaunch Update Service (via dns_query)
id: b60922f1-ea3a-5253-bd33-873683b192e6
status: stable
description: This rule detects DNS query requests to "update.onelaunch.com". This domain is linked with the OneLaunch adware application. When the OneLaunch application is installed it will attempt to get updates from this domain.
references:
    - https://attack.mitre.org/techniques/T1056/
    - https://www.malwarebytes.com/blog/detections/pup-optional-onelaunch-silentcf
    - https://www.myantispyware.com/2020/12/14/how-to-uninstall-onelaunch-browser-removal-guide/
    - https://malware.guide/browser-hijacker/remove-onelaunch-virus/
author: Huntrule Team
date: 2026-01-01
tags:
    - attack.credential-access
    - attack.collection
    - attack.t1056
logsource:
    category: dns_query
    product: windows
detection:
    selection:
        QueryName: 'update.onelaunch.com'
        Image|endswith: '\OneLaunch.exe'
    condition: selection
falsepositives:
    - Unknown
level: low