Registry Import from ProgramData Directory
Detects regedit.exe being used to import a registry (.reg) file located in the C:\ProgramData\ directory. This technique is utilized in the Nimbus RAT attack chain, where users are socially engineered via Teams to manually import a pre-staged .reg file (e.g., InboxCorePro.reg) to establish persistence on the host.
Microsoft Sentinel (KQL)
