TrymeLocker Active Setup Persistence via RAGE-MASTER StubPath to win_guard_*.exe

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•6

Detects the modification of registry keys within the Active Setup 'Installed Components' path, specifically targeting keys named '{RAGE-MASTER}'. The rule flags the creation or modification of a 'StubPath' value or any value containing 'win_guard_' or 'RageCore_', which are typical indicators of persistence mechanisms used by malware to execute code upon user logon.