Change User Account Associated with the FAX Service

Title: Change User Account Associated with the FAX Service
Status: test
Description:Detect change of the user account associated with the FAX service to avoid the escalation problem.
References:
  -https://twitter.com/dottor_morte/status/1544652325570191361
  -https://raw.githubusercontent.com/RiccardoAncarani/talks/master/F-Secure/unorthodox-lateral-movement.pdf
Author: frack113
Date: 2022-07-17
modified:2022-12-30
Tags:

• -'attack.persistence'
• -'attack.defense-impairment'
• -'attack.t1112'

Logsource:

• product: windows
• category: registry_set

Detection:
  selection:
    TargetObject: 'HKLM\System\CurrentControlSet\Services\Fax\ObjectName'
  filter:
    Details|contains: 'NetworkService'
  condition:selection and not filter
Falsepositives:
  -Unknown
Level: high