Windows: Detect rcedit editing PE version/resource metadata via --set-*

Alerts on rcedit command-line usage that sets PE metadata fields to alter executable file properties.

FreeUnreviewedSigmamediumv1

windows-detect-rcedit-editing-pe-version-resource-metadata-via-set-0c92f2e6

title: "Windows: Detect rcedit editing PE version/resource metadata via --set-*"
id: 1170d02d-c033-4693-bfbb-777bce78711d
status: test
description: This rule flags process executions of rcedit (rcedit-x86.exe or rcedit-x64.exe) where the command line includes --set- and PE metadata field names such as OriginalFileName, CompanyName, FileDescription, ProductName, ProductVersion, or LegalCopyright. Attackers and analysts may use this to modify executable properties to support stealth, such as making renamed or repackaged binaries less obvious. It relies on Windows process creation telemetry capturing the executable image path, product string, and the full command line arguments.
references:
  - https://security.stackexchange.com/questions/210843/is-it-possible-to-change-original-filename-of-an-exe
  - https://www.virustotal.com/gui/file/02e8e8c5d430d8b768980f517b62d7792d690982b9ba0f7e04163cbc1a6e7915
  - https://github.com/electron/rcedit
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_rcedit_execution.yml
author: Micah Babinski, Huntrule Team
date: 2022-12-11
modified: 2023-03-05
tags:
  - attack.stealth
  - attack.t1036.003
  - attack.t1036
  - attack.t1027.005
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \rcedit-x64.exe
        - \rcedit-x86.exe
    - Description: Edit resources of exe
    - Product: rcedit
  selection_flags:
    CommandLine|contains: --set-
  selection_attributes:
    CommandLine|contains:
      - OriginalFileName
      - CompanyName
      - FileDescription
      - ProductName
      - ProductVersion
      - LegalCopyright
  condition: all of selection_*
falsepositives:
  - Legitimate use of the tool by administrators or users to update metadata of a binary
level: medium
license: DRL-1.1
related:
  - id: 0c92f2e6-f08f-4b73-9216-ecb0ca634689
    type: derived

What it detects

This rule flags process executions of rcedit (rcedit-x86.exe or rcedit-x64.exe) where the command line includes --set- and PE metadata field names such as OriginalFileName, CompanyName, FileDescription, ProductName, ProductVersion, or LegalCopyright. Attackers and analysts may use this to modify executable properties to support stealth, such as making renamed or repackaged binaries less obvious. It relies on Windows process creation telemetry capturing the executable image path, product string, and the full command line arguments.

Known false positives

Legitimate use of the tool by administrators or users to update metadata of a binary

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.