SystemBC Coroxy SOCKS5 C2 Beaconing — Ports 4001/4002, Known IPs, Office-Spawn Chain
Detects persistent outbound network connections to known SystemBC (Coroxy) C2 infrastructure and Tor gateway IP addresses. The rule identifies suspicious beaconing behavior characterized by repeated connections over ports 4001 or 4002, originating from processes in user-writable directories, and correlates these with process lineage from common office applications or browsers.
CQL
