Add reg.exe

Reg.exe for Qakbot defense evasion.
https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB17_28.02.2023.txt
xcopy  C:\Windows\\\\\\system32\\\\\\reg.exe C:\Users\Admin\AppData\Local\Temp\glanduleHoratory.exe /h /s /e

rules/windows/process_creation/proc_creation_win_renamed_binary_highly_relevant.yml

@@ -52,6 +52,7 @@ detection:
             - 'rundll32.exe'
             - 'cmstp.exe'
             - 'msiexec.exe'
+            - 'reg.exe'
     filter:
         Image|endswith:
             - '\powershell.exe'
@@ -69,6 +70,7 @@ detection:
             - '\rundll32.exe'
             - '\cmstp.exe'
             - '\msiexec.exe'
+            - '\reg.exe'
     condition: selection and not filter
 falsepositives:
     - Custom applications use renamed binaries adding slight change to binary name. Typically this is easy to spot and add to whitelist