PDF Line-Range Script Extraction (AsyncRAT)

Ibrahim Saud@tektrix

•updated Jun 18, 2026•1•0•4

This rule detects the execution of 'cmd.exe' with a command line that includes 'type', '.pdf', 'more', and 'findstr'. This specific combination of commands is indicative of a technique used by AsyncRAT to extract and execute malicious code hidden within a decoy PDF file by reading specific line ranges.