T1546.003: WMI Realtek-named EventFilter/Consumer Triggers RtkNGUI64.exe Backdoor

Tim Peck@timpeck

•updated Aug 17, 2026•13•1•58

KQL Query from file: T1546.003: WMI Realtek-named EventFilter/Consumer Triggers RtkNGUI64.exe Backdoor