Subtitles Decoy GZip Decompression (AsyncRAT)
Detects PowerShell reading and decompressing a disguised GZip stream named "Subtitles" which is often used to deliver further stage payloads, specifically associated with AsyncRAT.
Microsoft Sentinel (KQL)
