TrymeLocker WH_KEYBOARD_LL Hook from win_guard_ or RageCore_ Process

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

This rule detects the execution of processes named win_guard_*.exe or those residing in directories often used for malicious staging (Users\Public, Windows\Temp, ProgramData). Additionally, it detects when these identified suspicious processes load user32.dll, a common indicator of initiating a low-level keyboard hook (WH_KEYBOARD_LL) often used by keyloggers to capture user input.