SystemBC Registry Run Key Persistence via socks5 Value or Hidden PowerShell

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•6

Detects SystemBC (Coroxy) malware attempting to establish persistence by writing to Windows Registry Run or RunOnce keys. The rule specifically monitors for registry value names associated with 'socks5' proxy functionality, the presence of 'stmbc.exe' in registry data, or hidden PowerShell command strings often used by the malware for execution.