AsyncRAT - Multi-Zone Line-Range PDF Extraction (T1204.002)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•1

Detects weaponized LNK shortcut execution where native Windows tools (more, type, findstr) are abused to carve out and execute specific line-range payloads hidden inside decoy PDF containers.