Realtek Audio Diagnostics Spoofing (AsyncRAT)

Ibrahim Saud@tektrix

•updated Jun 18, 2026•5•1•14

This rule detects the execution of PowerShell or batch scripts that mimic legitimate Realtek audio services, a known tactic used by AsyncRAT. Specifically, it looks for process command lines containing "RealtekAudioService64.ps1", "RealtekAudioService64.bat", "RealtekAudioEnhancements64.ahk", or "RtkNGUI64.ahk".