Potential PendingFileRenameOperations Tampering

Status: test
Severity: medium
Log source: category registry_set, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

Detect changes to the "PendingFileRenameOperations" registry key from uncommon or suspicious images locations to stage currently used files for rename or deletion after reboot.

Known false positives

Installers and updaters may set currently in use files for rename or deletion after a reboot.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1036.003` Masquerading: Rename Legitimate Utilities

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: Potential PendingFileRenameOperations Tampering
id: 4eec988f-7bf0-49f1-8675-1e6a510b3a2a
status: test
description: |
    Detect changes to the "PendingFileRenameOperations" registry key from uncommon or suspicious images locations to stage currently used files for rename or deletion after reboot.
references:
    - https://any.run/report/3ecd4763ffc944fdc67a9027e459cd4f448b1a8d1b36147977afaf86bbf2a261/64b0ba45-e7ce-423b-9a1d-5b4ea59521e6
    - https://devblogs.microsoft.com/scripting/determine-pending-reboot-statuspowershell-style-part-1/
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc960241(v=technet.10)?redirectedfrom=MSDN
    - https://www.trendmicro.com/en_us/research/21/j/purplefox-adds-new-backdoor-that-uses-websockets.html
    - https://www.trendmicro.com/en_us/research/19/i/purple-fox-fileless-malware-with-rookit-component-delivered-by-rig-exploit-kit-now-abuses-powershell.html
author: frack113
date: 2023-01-27
modified: 2025-10-07
tags:
    - attack.stealth
    - attack.t1036.003
logsource:
    category: registry_set
    product: windows
detection:
    selection_main:
        TargetObject|contains: '\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations'
    selection_susp_paths:
        Image|contains: '\Users\Public\'
            # - '\AppData\Local\Temp\'  # Commented out as it's used by legitimate installers
    selection_susp_images:
        Image|endswith:
            - '\reg.exe'
            - '\regedit.exe'
    condition: selection_main and 1 of selection_susp_*
falsepositives:
    - Installers and updaters may set currently in use files for rename or deletion after a reboot.
level: medium

Stages and Predicates

Stage 0: `condition`

selection_main and 1 of selection_susp_*

Stage 1: `selection_main`

selection_main:
    TargetObject|contains: '\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations'

Stage 2: `selection_susp_paths`

selection_susp_paths:
    Image|contains: '\Users\Public\'

Stage 3: `selection_susp_images`

selection_susp_images:
    Image|endswith:
        - '\reg.exe'
        - '\regedit.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\reg.exe` corpus 58 (sigma 58) `\regedit.exe` corpus 8 (sigma 8)	`field:"Image" kind:ends_with`
`Image`	match	`\Users\Public\` corpus 9 (sigma 9)	`field:"Image" kind:match value:"\Users\Public\"`
`TargetObject`	match	`\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations`	`field:"TargetObject" kind:match value:"\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations"`