TrymeLocker RageGuard Scheduled Task Creation from Suspicious Paths

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•3

Detects the creation of scheduled tasks using schtasks.exe initiated from potentially suspicious parent directories (C:\Users\Public\ or C:\Windows\Temp\) or parent processes containing 'win_guard_'. This behavior is often associated with malware attempting persistence.