Uncommon Extension In Keyboard Layout IME File Registry Value
Detects the modification of the 'Ime File' registry value within the 'Keyboard Layouts' key to include an uncommon file extension. This technique can be used by attackers to load a malicious DLL into a process via the Windows Input Method Editor (IME) feature, typically after sending a WM_INPUTLANGCHANGEREQUEST message. The rule specifically looks for modifications where the 'Ime File' value does not end with the standard '.ime' extension, indicating potential malicious activity.
Sigma
