SystemBC Coroxy SOCKS5 RAT Behavioral Execution and Persistence Indicators

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects behavioral indicators of the SystemBC (Coroxy) malware, including suspicious task scheduling, hidden PowerShell relaunch routines, use of staging binary names, and anomalous svchost.exe injection patterns. This rule focuses on detecting the multi-stage persistence and proxy behavior typical of SystemBC in pre-ransomware intrusion chains.