diff --git a/rules/windows/process_creation/proc_creation_susp_rcedit_execution.yml b/rules/windows/process_creation/proc_creation_susp_rcedit_execution.yml index c9ca2c50d..776cd622a 100644 --- a/rules/windows/process_creation/proc_creation_susp_rcedit_execution.yml +++ b/rules/windows/process_creation/proc_creation_susp_rcedit_execution.yml @@ -1,4 +1,4 @@ -title: Potential Metadata Tamper Using Rcedit +title: Potential PE Metadata Tamper Using Rcedit id: 0c92f2e6-f08f-4b73-9216-ecb0ca634689 status: experimental description: Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.