RtkNGUI64.exe spawns cmd.exe for CMD= tasking (SYSTEM/PUT/TIME, with or without timeout wrapper)

Duo Tech@duotech

•updated Aug 17, 2026•1•0•5

Consolidated detection for RtkNGUI64.exe spawning cmd.exe to execute CMD= tasking (SYSTEM/PUT/TIME verbs). Merges two previously separate rules that detected the same underlying signal via different tasking-mechanism angles.