Registry Import from ProgramData
Detects the use of regedit.exe to silently or explicitly import a .reg file located in the C:\ProgramData\ directory. This technique is used by threat actors, such as those deploying Nimbus RAT, to establish persistence.
Sigma
