RtkNGUI64 backdoor writes command output to tempcache.tmp
Detects RtkNGUI64.exe creating or writing to tempcache.tmp during command-output staging, scoped to direct process attribution. The rename-away leg of this file's lifecycle is covered by the separate put-command drop-and-rename detection.
Microsoft Sentinel (KQL)
