Change the Fax Dll

Title: Change the Fax Dll
Status: test
Description:Detect possible persistence using Fax DLL load when service restart
References:
  -https://twitter.com/dottor_morte/status/1544652325570191361
  -https://raw.githubusercontent.com/RiccardoAncarani/talks/master/F-Secure/unorthodox-lateral-movement.pdf
Author: frack113
Date: 2022-07-17
modified:2022-12-30
Tags:

• -'attack.persistence'
• -'attack.defense-impairment'
• -'attack.t1112'

Logsource:

• product: windows
• category: registry_set

Detection:
  selection:
    TargetObject|contains|all:
      -'\Software\Microsoft\Fax\Device Providers\'
      -'\ImageName'

  filter:
    Details: '%systemroot%\system32\fxst30.dll'
  condition:selection and not filter
Falsepositives:
  -Unknown
Level: high