Windows Registry: Monitor PendingFileRenameOperations changes from suspicious images

Alerts on registry tampering of PendingFileRenameOperations by processes running from suspicious image paths.

FreeUnreviewedSigmamediumv1

windows-registry-monitor-pendingfilerenameoperations-changes-from-suspicious-ima-4eec988f

title: "Windows Registry: Monitor PendingFileRenameOperations changes from suspicious images"
id: 9d9bf06b-ad73-4ace-891f-4e0a685eb2bd
status: test
description: This rule flags updates to the PendingFileRenameOperations registry value under the Session Manager key when the originating Image path matches uncommon, suspicious locations. Attackers can use this mechanism to stage file renames or deletions after reboot while reducing the need for immediate disruption. It relies on Windows registry set telemetry, including TargetObject and the process Image that performed the change, to identify potentially tampering activity.
references:
  - https://any.run/report/3ecd4763ffc944fdc67a9027e459cd4f448b1a8d1b36147977afaf86bbf2a261/64b0ba45-e7ce-423b-9a1d-5b4ea59521e6
  - https://devblogs.microsoft.com/scripting/determine-pending-reboot-statuspowershell-style-part-1/
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc960241(v=technet.10)?redirectedfrom=MSDN
  - https://www.trendmicro.com/en_us/research/21/j/purplefox-adds-new-backdoor-that-uses-websockets.html
  - https://www.trendmicro.com/en_us/research/19/i/purple-fox-fileless-malware-with-rookit-component-delivered-by-rig-exploit-kit-now-abuses-powershell.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_susp_pendingfilerenameoperations.yml
author: frack113, Huntrule Team
date: 2023-01-27
modified: 2025-10-07
tags:
  - attack.stealth
  - attack.t1036.003
logsource:
  category: registry_set
  product: windows
detection:
  selection_main:
    TargetObject|contains: \CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
  selection_susp_paths:
    Image|contains: \Users\Public\
  selection_susp_images:
    Image|endswith:
      - \reg.exe
      - \regedit.exe
  condition: selection_main and 1 of selection_susp_*
falsepositives:
  - Installers and updaters may set currently in use files for rename or deletion after a reboot.
level: medium
license: DRL-1.1
related:
  - id: 4eec988f-7bf0-49f1-8675-1e6a510b3a2a
    type: derived

What it detects

This rule flags updates to the PendingFileRenameOperations registry value under the Session Manager key when the originating Image path matches uncommon, suspicious locations. Attackers can use this mechanism to stage file renames or deletions after reboot while reducing the need for immediate disruption. It relies on Windows registry set telemetry, including TargetObject and the process Image that performed the change, to identify potentially tampering activity.

Known false positives

Installers and updaters may set currently in use files for rename or deletion after a reboot.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.