Windows Registry: User Account Changed for FAX Service

Flags registry changes that alter the FAX service’s associated user account on Windows.

FreeUnreviewedSigmahighv1

windows-registry-user-account-changed-for-fax-service-e3fdf743

title: "Windows Registry: User Account Changed for FAX Service"
id: b876abff-6a52-4a91-84c8-0f1905948a0f
status: test
description: This rule identifies when the user account associated with the Windows FAX service is changed via the registry. Attackers can use service logon account changes to redirect service execution and potentially support persistence or defense impairment. It relies on registry set telemetry targeting the FAX service ObjectName value under HKLM\System\CurrentControlSet\Services\Fax.
references:
  - https://twitter.com/dottor_morte/status/1544652325570191361
  - https://raw.githubusercontent.com/RiccardoAncarani/talks/master/F-Secure/unorthodox-lateral-movement.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_fax_change_service_user.yml
author: frack113, Huntrule Team
date: 2022-07-17
modified: 2022-12-30
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject: HKLM\System\CurrentControlSet\Services\Fax\ObjectName
  filter:
    Details|contains: NetworkService
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: e3fdf743-f05b-4051-990a-b66919be1743
    type: derived

What it detects

This rule identifies when the user account associated with the Windows FAX service is changed via the registry. Attackers can use service logon account changes to redirect service execution and potentially support persistence or defense impairment. It relies on registry set telemetry targeting the FAX service ObjectName value under HKLM\System\CurrentControlSet\Services\Fax.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.