Run Key Persistence Pointing to RageCore/TrymeLocker win_guard Executable
This rule detects potential persistence mechanisms on Windows systems where a registry run key is configured to launch an executable associated with the RageCore malware or win_guard utility. It monitors for the creation or modification of registry entries within the Windows Run registry keys that reference these specific strings.
Sigma
