SystemBC Persistence via Scheduled Task Creation from ProgramData
Detects the creation of scheduled tasks using schtasks.exe where the command originates from or references the C:\ProgramData\ directory. This pattern is consistent with the SystemBC (Coroxy) malware's persistence mechanism, where a randomly named executable is staged in ProgramData and configured for execution via Task Scheduler.
Microsoft Sentinel (KQL)
