SystemBC PowerShell Second-Stage Payload Delivery and C2

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the execution of PowerShell with suspicious flags, obfuscation, or download cradles often used by the SystemBC/Coroxy malware to facilitate second-stage payload delivery and C2 activity.