Potential PendingFileRenameOperations Tampering
Detects modifications to the "PendingFileRenameOperations" registry key when initiated by suspicious or uncommon executable locations or by specific system utilities like `reg.exe` or `regedit.exe`. This registry key is used by Windows to stage files for renaming or deletion after a system reboot, and its manipulation can be a defense evasion technique to replace legitimate files with malicious ones or to remove forensic artifacts.
Sigma
