TrymeLocker Active Setup Registry Persistence via Suspicious StubPath (T1547.014)

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects modifications to Windows Active Setup registry keys involving suspicious StubPath values or the creation of the specific {RAGE-MASTER} registry key associated with TrymeLocker malware. This technique is used to maintain persistence by executing malicious code upon user login.