APT28 SimpleLoader: rundll32.exe Loading tables(1).dll or DLLs from Temp/ProgramData
This rule detects potentially malicious usage of rundll32.exe by monitoring for specific command-line indicators associated with APT28, as well as the execution of DLL files from commonly abused directories like Temp, tmp, or ProgramData.
Microsoft Sentinel (KQL)
