TrymeLocker RageGuard Scheduled Task Creation for Persistence
Detects the creation of a scheduled task named 'RageGuard' or containing 'RageGuard' in its command line, often associated with TrymeLocker malware. The rule monitors for Task Scheduler Event IDs 4698 and 106, as well as schtasks process command line arguments used to create such tasks.
Splunk (SPL)
