SystemBC Scheduled Task Persistence Targeting ProgramData

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects the creation of scheduled tasks using schtasks.exe that point to the ProgramData directory, which is a common persistence location for malware like SystemBC. The rule excludes common, benign software installers and updaters that frequently use this directory to avoid false positives.