WMI 'Realtek' EventFilter/Consumer triggers backdoor at 19:50 daily
Requires the 'Realtek'-named WMI object AND (the 19:50 time-trigger query pattern OR the RtkNGUI64.exe destination) together, rather than matching on the name alone -- avoids flagging unrelated benign WMI objects that happen to share the name.
Microsoft Sentinel (KQL)
