TrymeLocker Scheduled Task Creation Combined with Recovery Inhibition

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects the creation of a scheduled task named 'RageGuard' correlated with commands known to inhibit system recovery, such as modifying boot configuration with bcdedit or deleting volume shadow copies/backups using vssadmin or wbadmin, within the same process execution chain.