SystemBC/Coroxy Scheduled Task Persistence via schtasks.exe to ProgramData
Detects evidence of SystemBC (Coroxy) malware persistence, characterized by the creation of a scheduled task using 'schtasks.exe' that executes a random binary residing in '%ProgramData%' with a 'start' argument, coupled with concurrent modifications to the Windows 'Run' registry keys in a persistent path.
YARA-L
