Potential PendingFileRenameOperations Tampering

calendar Aug 14, 2025 · attack.defense-evasion attack.t1036.003  ·
Share on: linkedin copy

Detect changes to the "PendingFileRenameOperations" registry key from uncommon or suspicious images locations to stage currently used files for rename or deletion after reboot.

Sigma rule (View on GitHub)

 1title: Potential PendingFileRenameOperations Tampering
 2id: 4eec988f-7bf0-49f1-8675-1e6a510b3a2a
 3status: test
 4description: |
 5        Detect changes to the "PendingFileRenameOperations" registry key from uncommon or suspicious images locations to stage currently used files for rename or deletion after reboot.
 6references:
 7    - https://any.run/report/3ecd4763ffc944fdc67a9027e459cd4f448b1a8d1b36147977afaf86bbf2a261/64b0ba45-e7ce-423b-9a1d-5b4ea59521e6
 8    - https://devblogs.microsoft.com/scripting/determine-pending-reboot-statuspowershell-style-part-1/
 9    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc960241(v=technet.10)?redirectedfrom=MSDN
10    - https://www.trendmicro.com/en_us/research/21/j/purplefox-adds-new-backdoor-that-uses-websockets.html
11    - https://www.trendmicro.com/en_us/research/19/i/purple-fox-fileless-malware-with-rookit-component-delivered-by-rig-exploit-kit-now-abuses-powershell.html
12author: frack113
13date: 2023-01-27
14modified: 2024-07-03
15tags:
16    - attack.defense-evasion
17    - attack.t1036.003
18logsource:
19    category: registry_set
20    product: windows
21detection:
22    selection_main:
23        TargetObject|contains: '\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations'
24    selection_susp_paths:
25        Image|contains:
26            - '\AppData\Local\Temp\'
27            - '\Users\Public\'
28    selection_susp_images:
29        Image|endswith:
30            - '\reg.exe'
31            - '\regedit.exe'
32    condition: selection_main and 1 of selection_susp_*
33falsepositives:
34    - Installers and updaters may set currently in use files for rename or deletion after a reboot.
35level: medium

References

Related rules

to-top