PUA - Potential PE Metadata Tamper Using Rcedit

Title: PUA - Potential PE Metadata Tamper Using Rcedit
Status: test
Description:Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.
References:
  -https://security.stackexchange.com/questions/210843/is-it-possible-to-change-original-filename-of-an-exe
  -https://www.virustotal.com/gui/file/02e8e8c5d430d8b768980f517b62d7792d690982b9ba0f7e04163cbc1a6e7915
  -https://github.com/electron/rcedit
Author: Micah Babinski
Date: 2022-12-11
modified:2023-03-05
Tags:

• -'attack.stealth'
• -'attack.t1036.003'
• -'attack.t1036'
• -'attack.t1027.005'
• -'attack.t1027'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    - Image|endswith:
      - '\rcedit-x64.exe'
      - '\rcedit-x86.exe'
Description:'Edit resources of exe' Product:'rcedit'   selection_flags:
    CommandLine|contains: '--set-'
  selection_attributes:
    CommandLine|contains:
      -'OriginalFileName'
      -'CompanyName'
      -'FileDescription'
      -'ProductName'
      -'ProductVersion'
      -'LegalCopyright'

  condition:all of selection_*
Falsepositives:
  -Legitimate use of the tool by administrators or users to update metadata of a binary
Level: medium