{"id":"0c92f2e6-f08f-4b73-9216-ecb0ca634689","title":"PUA - Potential PE Metadata Tamper Using Rcedit","description":"Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.","author":"Micah Babinski","status":"test","level":"medium","date":"2022-12-11","modified":"2023-03-05","tags":["attack.stealth","attack.t1036.003","attack.t1036","attack.t1027.005","attack.t1027"],"technique_ids":["T1027","T1027.005","T1036","T1036.003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate use of the tool by administrators or users to update metadata of a binary"],"references":["https://security.stackexchange.com/questions/210843/is-it-possible-to-change-original-filename-of-an-exe","https://www.virustotal.com/gui/file/02e8e8c5d430d8b768980f517b62d7792d690982b9ba0f7e04163cbc1a6e7915","https://github.com/electron/rcedit"],"source_path":"rules/windows/process_creation/proc_creation_win_pua_rcedit_execution.yml","source_sha256":"ec33a72885e54d6d60b46e112cc308e59a3394e95f1fb1181adf650bb771ded7","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_rcedit_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PUA - Potential PE Metadata Tamper Using Rcedit\nid: 0c92f2e6-f08f-4b73-9216-ecb0ca634689\nstatus: test\ndescription: Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.\nreferences:\n    - https://security.stackexchange.com/questions/210843/is-it-possible-to-change-original-filename-of-an-exe\n    - https://www.virustotal.com/gui/file/02e8e8c5d430d8b768980f517b62d7792d690982b9ba0f7e04163cbc1a6e7915\n    - https://github.com/electron/rcedit\nauthor: Micah Babinski\ndate: 2022-12-11\nmodified: 2023-03-05\ntags:\n    - attack.stealth\n    - attack.t1036.003\n    - attack.t1036\n    - attack.t1027.005\n    - attack.t1027\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith:\n              - '\\rcedit-x64.exe'\n              - '\\rcedit-x86.exe'\n        - Description: 'Edit resources of exe'\n        - Product: 'rcedit'\n    selection_flags:\n        CommandLine|contains: '--set-' # Covers multiple edit commands such as \"--set-resource-string\" or \"--set-version-string\"\n    selection_attributes:\n        CommandLine|contains:\n            - 'OriginalFileName'\n            - 'CompanyName'\n            - 'FileDescription'\n            - 'ProductName'\n            - 'ProductVersion'\n            - 'LegalCopyright'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate use of the tool by administrators or users to update metadata of a binary\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1027","id":"T1027","name":"Obfuscated Files or Information","page":"techniques/enterprise/T1027/"},{"key":"enterprise/T1027.005","id":"T1027.005","name":"Indicator Removal from Tools","page":"techniques/enterprise/T1027.005/"},{"key":"enterprise/T1036","id":"T1036","name":"Masquerading","page":"techniques/enterprise/T1036/"},{"key":"enterprise/T1036.003","id":"T1036.003","name":"Rename Legitimate Utilities","page":"techniques/enterprise/T1036.003/"}],"data_path":"data/detection-rules/0c92f2e6-f08f-4b73-9216-ecb0ca634689.json","kind":"sigma"}