TrymeLocker Scheduled Task Persistence via schtasks /Create (RageGuard)

Ibrahim Saud@tektrix

•updated Jun 28, 2026•1•0•2

Detects the creation of scheduled tasks named 'RageGuard' or utilizing 'win_guard' binary paths in suspicious directories (Temp, AppData, ProgramData), correlated with concurrent registry modifications to Winlogon (Shell/Userinit) or Image File Execution Options (Debugger) using the same binary, indicative of the TrymeLocker ransomware persistence mechanism.