APT41 ToughProgress PLUSDROP - Rundll32 Loading Image-Extension Payload
Detects the use of rundll32.exe to process files with common image extensions (.jpg, .jpeg, .png, .bmp, .gif). This behavior is often associated with steganography or attempts to disguise malicious payloads by masquerading them as image files.
Microsoft Sentinel (KQL)
