Windows DNS Queries to update.onelaunch.com by OneLaunch.exe
Flags DNS requests to update.onelaunch.com from OneLaunch.exe on Windows.
FreeReviewedSigma · Low · v2
- Product
- windows
- Category
- dns_query
- Author
- Josh Nickels (SigmaHQ), DRL 1.1
- Published
- 2024-02-26
- Updated
- 2026-07-31
ATT&CK techniques
Cred Access → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
Identifies DNS query requests for update.onelaunch.com generated by OneLaunch.exe on Windows. Querying this update endpoint matters because installed adware or unwanted software may periodically check for updates or additional payloads. The rule relies on DNS query telemetry (QueryName) and process context from the initiating executable path (Image ending in \OneLaunch.exe).
Reporting behind it
- malwarebytes.comhttps://www.malwarebytes.com/blog/detections/pup-optional-onelaunch-silentcf
- myantispyware.comhttps://www.myantispyware.com/2020/12/14/how-to-uninstall-onelaunch-browser-removal-guide/
- malware.guidehttps://malware.guide/browser-hijacker/remove-onelaunch-virus/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_onelaunch_update_service.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-onelaunch-update-domain-dns-queries-via-onelaunch-exe-df68f791
title: Windows DNS Queries to update.onelaunch.com by OneLaunch.exe
id: 09f2474c-8cbd-4171-880c-e2e13d45d4af
status: test
description: Identifies DNS query requests for update.onelaunch.com generated by OneLaunch.exe on Windows. Querying this update endpoint matters because installed adware or unwanted software may periodically check for updates or additional payloads. The rule relies on DNS query telemetry (QueryName) and process context from the initiating executable path (Image ending in \OneLaunch.exe).
references:
- https://www.malwarebytes.com/blog/detections/pup-optional-onelaunch-silentcf
- https://www.myantispyware.com/2020/12/14/how-to-uninstall-onelaunch-browser-removal-guide/
- https://malware.guide/browser-hijacker/remove-onelaunch-virus/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_onelaunch_update_service.yml
author: Josh Nickels, Huntrule Team
date: 2024-02-26
tags:
- attack.credential-access
- attack.collection
- attack.t1056
logsource:
category: dns_query
product: windows
detection:
selection:
QueryName: update.onelaunch.com
Image|endswith: \OneLaunch.exe
condition: selection
falsepositives:
- Unlikely
level: low
license: DRL-1.1
related:
- id: df68f791-ad95-447f-a271-640a0dab9cf8
type: derived