SystemBC SOCKS5 C2 Proxy Tunnel on Non-Standard Port (TCP 4001)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects outbound network connections to TCP port 4001, which is the hardcoded default C2 port for SystemBC (Coroxy) malware. The rule identifies suspicious proxy tunnel establishment from Windows workstations, often used by threat actors like Wizard Spider and FIN7 for pre-deployment staging.