SystemBC Persistence via Scheduled Task Creation in ProgramData

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•9

This rule detects persistence mechanisms associated with the SystemBC/Coroxy malware. It monitors for three indicators: 1) The creation of scheduled tasks via 'schtasks.exe' where the task binary is located in 'ProgramData' and uses the 'start' argument; 2) Windows Security Event ID 4698 (Scheduled Task Created) identifying similar task actions in 'ProgramData' with the 'start' argument; 3) The creation of Registry Run keys in 'HKCU' or 'HKLM' with values containing 'ProgramData' combined with malicious arguments such as 'start', '-windowstyle hidden', or '-ep bypass'.