SystemBC Process Injection into svchost/explorer/Browser with SOCKS5 C2 Correlation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects a process injection event where a process running from a suspicious directory (e.g., Temp, AppData, ProgramData) injects code into a common system or browser process, followed by that same process initiating a network connection to non-internal IP ranges on specific ports within a 10-minute window. This behavior is indicative of malware establishing persistence or C2 communications.