WMI consumer launches RtkNGUI64.exe via 8.3 short path Progra~1\Realtek\Audio
Detects RtkNGUI64.exe being launched via a WMI consumer using the 8.3 short-path form (Progra~1\Realtek\Audio), the same masquerading binary used for backdoor persistence.
Microsoft Sentinel (KQL)
