Reg.exe Detections added

[gbL2k]

Summary of the Pull Request

Added rules to detect the use of reg.exe to query registry about OS/Time Zone information

Changelog

new: OS Product Name Discovery via reg.exe
new: OS Build Number Discovery via reg.exe
new: Time Zone Discovery via reg.exe

Example Log Event:

OS Product Name Discovery via reg.exe:
Event ID 4688

OS Build Number Discovery via reg.exe:
Event ID 4688

Time Zone Discovery via reg.exe:
Event ID 4688

Relevant Links :

-https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1082/T1082.md#atomic-test-40---discover-os-build-number-via-registry
-https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1082/T1082.md#atomic-test-39---discover-os-product-name-via-registry
-https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1124/T1124.md#atomic-test-6---discover-system-time-zone-via-registry

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[github-actions]

Welcome @gbL2k 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions document to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃

[frack113]

Hi,
Can you please not remove the PR template and fill it.
It is very usefull for the reviewer.
Thanks.

[gbL2k]

I believe I've made the necessary changes, but let me know if I missed anything.

[gbL2k]

Just learned about the windash modifier and realized that the previous detections were easily bypassable,I have made the changes accordingly.