attack.t1056 | Detection.FYI

DNS Query Request To OneLaunch Update Service

Jan 6, 2025 · attack.collection attack.t1056 ·
Share on:

Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. When the OneLaunch application is installed it will attempt to get updates from this domain.

Read More
Suspicious Network Communication With IPFS

Aug 12, 2024 · attack.credential-access attack.t1056 ·
Share on:

Detects connections to interplanetary file system (IPFS) containing a user's email address which mirrors behaviours observed in recent phishing campaigns leveraging IPFS to host credential harvesting webpages.

Read More