Windows Registry: Monitor PendingFileRenameOperations changes from suspicious images
Alerts on registry tampering of PendingFileRenameOperations by processes running from suspicious image paths.
- Product
- windows
- Category
- registry_set
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2023-01-27
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags updates to the PendingFileRenameOperations registry value under the Session Manager key when the originating Image path matches uncommon, suspicious locations. Attackers can use this mechanism to stage file renames or deletions after reboot while reducing the need for immediate disruption. It relies on Windows registry set telemetry, including TargetObject and the process Image that performed the change, to identify potentially tampering activity.
Reporting behind it
- any.runhttps://any.run/report/3ecd4763ffc944fdc67a9027e459cd4f448b1a8d1b36147977afaf86bbf2a261/64b0ba45-e7ce-423b-9a1d-5b4ea59521e6
- devblogs.microsoft.comhttps://devblogs.microsoft.com/scripting/determine-pending-reboot-statuspowershell-style-part-1/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc960241(v=technet.10)?redirectedfrom=MSDN
- trendmicro.comhttps://www.trendmicro.com/en_us/research/21/j/purplefox-adds-new-backdoor-that-uses-websockets.html
- trendmicro.comhttps://www.trendmicro.com/en_us/research/19/i/purple-fox-fileless-malware-with-rookit-component-delivered-by-rig-exploit-kit-now-abuses-powershell.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_susp_pendingfilerenameoperations.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: Monitor PendingFileRenameOperations changes from suspicious images"
id: 9d9bf06b-ad73-4ace-891f-4e0a685eb2bd
status: test
description: This rule flags updates to the PendingFileRenameOperations registry value under the Session Manager key when the originating Image path matches uncommon, suspicious locations. Attackers can use this mechanism to stage file renames or deletions after reboot while reducing the need for immediate disruption. It relies on Windows registry set telemetry, including TargetObject and the process Image that performed the change, to identify potentially tampering activity.
references:
- https://any.run/report/3ecd4763ffc944fdc67a9027e459cd4f448b1a8d1b36147977afaf86bbf2a261/64b0ba45-e7ce-423b-9a1d-5b4ea59521e6
- https://devblogs.microsoft.com/scripting/determine-pending-reboot-statuspowershell-style-part-1/
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc960241(v=technet.10)?redirectedfrom=MSDN
- https://www.trendmicro.com/en_us/research/21/j/purplefox-adds-new-backdoor-that-uses-websockets.html
- https://www.trendmicro.com/en_us/research/19/i/purple-fox-fileless-malware-with-rookit-component-delivered-by-rig-exploit-kit-now-abuses-powershell.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_susp_pendingfilerenameoperations.yml
author: frack113, Huntrule Team
date: 2023-01-27
modified: 2025-10-07
tags:
- attack.stealth
- attack.t1036.003
logsource:
category: registry_set
product: windows
detection:
selection_main:
TargetObject|contains: \CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
selection_susp_paths:
Image|contains: \Users\Public\
selection_susp_images:
Image|endswith:
- \reg.exe
- \regedit.exe
condition: selection_main and 1 of selection_susp_*
falsepositives:
- Installers and updaters may set currently in use files for rename or deletion after a reboot.
level: medium
license: DRL-1.1
related:
- id: 4eec988f-7bf0-49f1-8675-1e6a510b3a2a
type: derived