Windows Fax Service DLL Search Order Hijack via ualapi.dll Side-Loading

Flags fxssvc.exe loading ualapi.dll from unexpected paths, indicating potential DLL side-loading for privilege escalation.

FreeUnreviewedSigmahighv1

windows-fax-service-dll-search-order-hijack-via-ualapi-dll-side-loading-828af599

title: Windows Fax Service DLL Search Order Hijack via ualapi.dll Side-Loading
id: c39467a7-bb06-4ced-a072-72d776d57b71
status: test
description: This rule identifies executions of the Windows fax service executable (fxssvc.exe) that load ualapi.dll from a non-WinSxS path. Attackers can exploit the service’s DLL loading behavior to side-load a malicious ualapi.dll and gain elevated execution. It relies on process image-load telemetry that records which DLLs were loaded for fxssvc.exe, and it excludes DLL loads originating from the WinSxS directory.
references:
  - https://windows-internals.com/faxing-your-way-to-system/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_ualapi.yml
author: NVISO, Huntrule Team
date: 2020-05-04
modified: 2022-06-02
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \fxssvc.exe
    ImageLoaded|endswith: ualapi.dll
  filter:
    ImageLoaded|startswith: C:\Windows\WinSxS\
  condition: selection and not filter
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 828af599-4c53-4ed2-ba4a-a9f835c434ea
    type: derived

What it detects

This rule identifies executions of the Windows fax service executable (fxssvc.exe) that load ualapi.dll from a non-WinSxS path. Attackers can exploit the service’s DLL loading behavior to side-load a malicious ualapi.dll and gain elevated execution. It relies on process image-load telemetry that records which DLLs were loaded for fxssvc.exe, and it excludes DLL loads originating from the WinSxS directory.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.