KB-prefixed AppData staging with tar extraction and renamed
Detects follow-on staging activity typically associated with Quick Assist abuse where an archive is extracted from Downloads to an AppDataRoamingRB[0-9]+ directory via command shell and tar, followed closely by the execution of a runtime from that directory.
Microsoft Sentinel (KQL)
