SystemBC process injection into svchost.exe or explorer.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects anomalous process creation where svchost.exe or explorer.exe is spawned by a process other than standard system parents (e.g., services.exe, wininit.exe). This behavior is consistent with SystemBC (Coroxy) reflective DLL loading or process hollowing, where malicious code is injected into core Windows processes to evade detection.