TrymeLocker Active Setup Registry Abuse for Persistence (T1547.014)

Ibrahim Saud@tektrix

•updated Jun 28, 2026•1•0•4

Detects the creation or modification of Windows Active Setup registry keys ('StubPath') used by TrymeLocker to achieve persistence. The rule monitors for keys pointing to executables in suspicious locations such as Windows Temp, Users Public, ProgramData, or AppData, and identifies specific threat-related patterns like 'win_guard_', 'RageCore_', and '{RAGE-MASTER}'.