Suspicious Rundll32/Svchost Execution via LNK with Malicious Payload Indicators
This detection identifies instances where Rundll32.exe or svchost.exe are executed by processes initiated through .lnk (shortcut) files, particularly those masquerading as PDFs or containing suspicious keywords like "申報物品清單" (Declaration of Items List). It further filters for command lines referencing potentially malicious file types such as .dll, .dat, .jpg, .zip, or .png, and checks for execution from common user or system directories often abused by malware (e.g., Temp, AppData, Public). This behavior is indicative of initial access or execution stages of malware campaigns, such as those involving the ToughProgress malware family.
Microsoft Sentinel (KQL)
