Hayabusa low test sigma

DNS Query Request To OneLaunch Update Service

Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. When the OneLaunch application is installed it will attempt to get updates from this domain.

View Source

Detection Logic

{
  "dns_query": {
    "EventID": 22,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": {
    "QueryName": "update.onelaunch.com",
    "Image
| endswith": "\\OneLaunch.exe"
  },
  "condition": "dns_query and selection"
}

False Positives

  • ⚠ Unlikely

Field Validations

Loading…

Comments (0)

Loading comments...