AsyncRAT - Decoy PDF Distraction Sub-second Execution
Detects the simultaneous launching of a clean decoy PDF and a malicious script (specifically PowerShell) within the same second, often used by malware like AsyncRAT for distraction during execution.
Microsoft Sentinel (KQL)

