For people who do Red Team work or those who handle malware reversing, forensics. Metadata in Windows PE files probably isn’t new to you. Attackers will try to remove or tamper with that metadata so the file looks legitimate or leaves as little trace as possible. Defenders, on the other hand, will look for such information to track activity and cluster related malware, or even tie it back to criminal groups. In this article, I’ll cover Operational Security (OPSEC) techniques for PE files on Windows. I’ll also release a toolkit to help check the most common metadata artifacts that both red teams and blue teams often rely on.
