Windows Cabinet File Extraction Via Expand to ProgramData

Detects usage of expand.exe to extract Microsoft Cabinet (CAB) archives, specifically when extracting into `C:\ProgramData` or similar staging locations. This behavior has been observed in recent APT37 activity where a CAB payload was expanded into ProgramData prior to persistence and execution, indicating ingress tool transfer and payload staging.