LoFP LoFP / legitimate use of the tool by administrators or users to update metadata of a binary

Techniques

Sample rules

PUA - Potential PE Metadata Tamper Using Rcedit

Description

Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.

Detection logic

condition: all of selection_*
selection_attributes:
  CommandLine|contains:
  - OriginalFileName
  - CompanyName
  - FileDescription
  - ProductName
  - ProductVersion
  - LegalCopyright
selection_flags:
  CommandLine|contains: --set-
selection_img:
- Image|endswith:
  - \rcedit-x64.exe
  - \rcedit-x86.exe
- Description: Edit resources of exe
- Product: rcedit