Suspicious Registry File Import via Reg.exe from User/Temp Paths
Detects the import of '.reg' files from suspicious user-controlled or temporary paths using the 'reg.exe' utility. This activity can be indicative of an adversary attempting to modify the Windows Registry for persistence, defense evasion, or other malicious purposes by importing registry keys from a location that is easily written to.
Sigma
