TrymeLocker Scheduled Task Persistence via RageGuard or Suspicious Path

Ibrahim Saud@tektrix

•updated Jun 28, 2026•1•0•1

Detects the creation of suspicious scheduled tasks associated with TrymeLocker ransomware. The rule monitors for tasks named 'RageGuard' or 'win_guard', as well as tasks registered with high privileges using non-standard file paths such as AppData, Temp, or ProgramData, triggered by system logon or startup.