Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
22 detections
Filters
Last updated
All Time
Detection languages
13
7
1
1
Contributors
7
6
3
1
1
Categories
12
5
3
2
2
Platforms
17
3
2
1
1
Products / Services
3
3
3
2
1
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
IDS Classtypes
1
IDS Protocols
1
Detects the use of the rcedit tool to modify Portable Executable (PE) metadata properties such as OriginalFileName, CompanyName, FileDescription, ProductName, ProductVersion, and LegalCopyright. This activity could indicate an attempt to conceal the true nature of an executable, potentially for defense evasion by masquerading as a legitimate utility or by removing indicators from malicious tools.
Page 2 of 2