From aca5dccd7fdda232309cb4698cebecb8280f71b3 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com> Date: Tue, 13 Dec 2022 00:01:46 +0100 Subject: [PATCH] fix: change title --- .../process_creation/proc_creation_susp_rcedit_execution.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/windows/process_creation/proc_creation_susp_rcedit_execution.yml b/rules/windows/process_creation/proc_creation_susp_rcedit_execution.yml index c9ca2c50d..776cd622a 100644 --- a/rules/windows/process_creation/proc_creation_susp_rcedit_execution.yml +++ b/rules/windows/process_creation/proc_creation_susp_rcedit_execution.yml @@ -1,4 +1,4 @@ -title: Potential Metadata Tamper Using Rcedit +title: Potential PE Metadata Tamper Using Rcedit id: 0c92f2e6-f08f-4b73-9216-ecb0ca634689 status: experimental description: Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.