Potential PendingFileRenameOperations Tampering

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detect changes to the "PendingFileRenameOperations" registry key from uncommon or suspicious images locations to stage currently used files for rename or deletion after reboot.