Unusual Extension In Keyboard Layout IME File Registry Value (via registry_set)

This rule detects use of Windows Input Method Editor (IME) keyboard layout feature, which enables an adversary to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message. Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path. IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.