AsyncRAT - Subtitles File Execution (T1204)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•6

Detects the anomalous execution or loading of files named "Subtitles" which actually contain decrypted .NET assemblies, specifically looking for command lines containing "Packages\Microsoft.WindowsSoundDiagnostics\Subtitles". This pattern is associated with AsyncRAT malware.