PUA - Potential PE Metadata Tamper Using Rcedit

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.