huntrule

Windows OneLaunch Update Domain DNS Queries via OneLaunch.exe

Flags DNS requests to update.onelaunch.com from OneLaunch.exe on Windows.

FreeUnreviewedSigmalowv1
title: Windows OneLaunch Update Domain DNS Queries via OneLaunch.exe
id: 09f2474c-8cbd-4171-880c-e2e13d45d4af
status: test
description: This rule identifies DNS queries for update.onelaunch.com generated by OneLaunch.exe. Adware installed on a Windows host may contact this update service to retrieve updates. The detection relies on DNS query telemetry (QueryName) and process context (the querying executable ending with \OneLaunch.exe).
references:
  - https://www.malwarebytes.com/blog/detections/pup-optional-onelaunch-silentcf
  - https://www.myantispyware.com/2020/12/14/how-to-uninstall-onelaunch-browser-removal-guide/
  - https://malware.guide/browser-hijacker/remove-onelaunch-virus/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_onelaunch_update_service.yml
author: Josh Nickels, Huntrule Team
date: 2024-02-26
tags:
  - attack.credential-access
  - attack.collection
  - attack.t1056
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    QueryName: update.onelaunch.com
    Image|endswith: \OneLaunch.exe
  condition: selection
falsepositives:
  - Unlikely
level: low
license: DRL-1.1
related:
  - id: df68f791-ad95-447f-a271-640a0dab9cf8
    type: derived

What it detects

This rule identifies DNS queries for update.onelaunch.com generated by OneLaunch.exe. Adware installed on a Windows host may contact this update service to retrieve updates. The detection relies on DNS query telemetry (QueryName) and process context (the querying executable ending with \OneLaunch.exe).

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.