The Gentlemen RaaS Malicious Service Installation in Suspicious Paths

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the creation of Windows services where the executable path is located in suspicious or volatile directories such as ProgramData, Temp, or AppData. This behavior is indicative of malware, specifically the The Gentlemen RaaS group, establishing persistence or deploying malicious components on a compromised system.