KQL_apt_sofacy.txt

SecurityEvent | where EventID == "4688" | where CommandLine matches regex "rundll32\.exe %APPDATA%\\\.*\.dat\",.*" or CommandLine matches regex "rundll32\.exe %APPDATA%\\\.*\.dll\",#1"