APT41 ToughProgress PLUSDROP - Rundll32 Loading Image-Extension Payload
Detects the execution of command interpreters (cmd.exe, powershell.exe, rundll32.exe) initiated by explorer.exe when the parent process command line or the child process command line indicates activity involving files located in user-writable 'Temp' or 'Downloads' directories, specifically targeting LNK files. This behavior is commonly associated with malicious shortcut files used as initial vectors for execution.
Microsoft Sentinel (KQL)
