TrymeLocker Scheduled Task Persistence via RageGuard with Suspicious Trigger and Path

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•3

Detects the creation of a Windows scheduled task using 'schtasks.exe' that triggers on system startup or login, while simultaneously referencing specific keywords ('RageGuard', 'win_guard_', 'RageCore_') in the command line, suggesting the persistence of a specific malicious utility.