Fax DLL Persistence via Registry Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

This rule detects modifications to the Windows Registry related to Fax Device Providers, specifically looking for changes to the 'ImageName' value within the 'Software\Microsoft\Fax\Device Providers\' path. This technique can be used for persistence by loading a malicious DLL when the Fax service restarts, as highlighted in the provided references.