The Gentlemen RaaS Scheduled Task Persistence via ProgramData or Temp

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

This rule detects the creation of scheduled tasks that point to executable files located in suspicious directories such as ProgramData, Temp, or AppData. This behavior is indicative of persistence mechanisms commonly employed by the The Gentlemen Ransomware-as-a-Service (RaaS) group to maintain access and execute malicious components like backdoors or ransomware binaries.