TrymeLocker Backdoor Account Creation via rage_master_ Pattern

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•3

Detects the execution of 'net.exe' or 'net1.exe' to create a new user account with a prefix indicative of potential persistence or backdooring (rage_master_). The rule further filters for executions originating from suspicious directories such as \Temp\, \Users\Public\, or \ProgramData\, which are common staging areas for malicious binaries.