Sigma low test sigma

DNS Query Request To OneLaunch Update Service

Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. When the OneLaunch application is installed it will attempt to get updates from this domain.

View Source

Detection Logic

{
  "selection": {
    "QueryName": "update.onelaunch.com",
    "Image
| endswith": "\\OneLaunch.exe"
  },
  "condition": "selection"
}

False Positives

  • ⚠ Unlikely

Field Validations

Loading…

Comments (0)

Loading comments...