attack.t1056 | Detection.FYI

DNS Query Request To OneLaunch Update Service

Oct 23, 2025 · attack.credential-access attack.collection attack.t1056 ·
Share on:

Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. When the OneLaunch application is installed it will attempt to get updates from this domain.

Read More
Suspicious Network Communication With IPFS

Oct 23, 2025 · attack.collection attack.credential-access attack.t1056 ·
Share on:

Detects connections to interplanetary file system (IPFS) containing a user's email address which mirrors behaviours observed in recent phishing campaigns leveraging IPFS to host credential harvesting webpages.

Read More