Change User Account Associated with the FAX Service
This rule detects modifications to the 'ObjectName' registry value for the Windows FAX service. Specifically, it triggers when the 'ObjectName' value is changed from anything other than 'NetworkService'. This change could indicate an adversary attempting to escalate privileges or establish persistence by associating the FAX service with a different user account, potentially one with higher privileges or a compromised account, to execute malicious code or maintain access.
Sigma
