Windows: Detect rcedit editing PE version/resource metadata via --set-*
Alerts on rcedit command-line usage that sets PE metadata fields to alter executable file properties.
- Product
- windows
- Category
- process_creation
- Author
- Micah Babinski (SigmaHQ), DRL 1.1
- Published
- 2022-12-11
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions of rcedit (rcedit-x86.exe or rcedit-x64.exe) where the command line includes --set- and PE metadata field names such as OriginalFileName, CompanyName, FileDescription, ProductName, ProductVersion, or LegalCopyright. Attackers and analysts may use this to modify executable properties to support stealth, such as making renamed or repackaged binaries less obvious. It relies on Windows process creation telemetry capturing the executable image path, product string, and the full command line arguments.
Reporting behind it
- security.stackexchange.comhttps://security.stackexchange.com/questions/210843/is-it-possible-to-change-original-filename-of-an-exe
- virustotal.comhttps://www.virustotal.com/gui/file/02e8e8c5d430d8b768980f517b62d7792d690982b9ba0f7e04163cbc1a6e7915
- github.comhttps://github.com/electron/rcedit
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_rcedit_execution.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect rcedit editing PE version/resource metadata via --set-*"
id: 1170d02d-c033-4693-bfbb-777bce78711d
status: test
description: This rule flags process executions of rcedit (rcedit-x86.exe or rcedit-x64.exe) where the command line includes --set- and PE metadata field names such as OriginalFileName, CompanyName, FileDescription, ProductName, ProductVersion, or LegalCopyright. Attackers and analysts may use this to modify executable properties to support stealth, such as making renamed or repackaged binaries less obvious. It relies on Windows process creation telemetry capturing the executable image path, product string, and the full command line arguments.
references:
- https://security.stackexchange.com/questions/210843/is-it-possible-to-change-original-filename-of-an-exe
- https://www.virustotal.com/gui/file/02e8e8c5d430d8b768980f517b62d7792d690982b9ba0f7e04163cbc1a6e7915
- https://github.com/electron/rcedit
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_rcedit_execution.yml
author: Micah Babinski, Huntrule Team
date: 2022-12-11
modified: 2023-03-05
tags:
- attack.stealth
- attack.t1036.003
- attack.t1036
- attack.t1027.005
- attack.t1027
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \rcedit-x64.exe
- \rcedit-x86.exe
- Description: Edit resources of exe
- Product: rcedit
selection_flags:
CommandLine|contains: --set-
selection_attributes:
CommandLine|contains:
- OriginalFileName
- CompanyName
- FileDescription
- ProductName
- ProductVersion
- LegalCopyright
condition: all of selection_*
falsepositives:
- Legitimate use of the tool by administrators or users to update metadata of a binary
level: medium
license: DRL-1.1
related:
- id: 0c92f2e6-f08f-4b73-9216-ecb0ca634689
type: derived