Potential PE Metadata Tampering Using Rcedit
Detects the use of the rcedit tool to modify Portable Executable (PE) metadata properties such as OriginalFileName, CompanyName, FileDescription, ProductName, ProductVersion, and LegalCopyright. This activity could indicate an attempt to conceal the true nature of an executable, potentially for defense evasion by masquerading as a legitimate utility or by removing indicators from malicious tools.
Sigma
