TrymeLocker RageService Windows Service Installation for Persistence

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects the installation of a Windows service associated with the TrymeLocker ransomware strain. The rule monitors System and Security event logs for specific service names ('rageservice') or file paths ('win_guard_', 'ragecore_') indicative of this malware's persistence mechanism.