APT41 ToughProgress PLUSDROP - Rundll32 Loading Image-Extension Payload
Detects the execution of rundll32.exe with command line arguments referencing image file extensions (jpg, jpeg, png, bmp, gif). This is a known technique for bypassing security controls or masquerading malicious code as standard image files.
Microsoft Sentinel (KQL)
