TrymeLocker cmd.exe Deletion Correlated with Service or Scheduled Task Creation

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects the unauthorized deletion of cmd.exe from System32 or SysWOW64 by a non-system process, correlated with the creation of a new service or scheduled task on the same host within 60 seconds, which is characteristic of TrymeLocker malware persistence and tampering.