SystemBC lateral tool transfer via SMB share write followed by remote service or task execution
Detects processes that exhibit signs of C2 communication (specifically on ports 4000-5000, associated with SystemBC) followed by the writing of executable or script files to SMB/UNC paths and subsequent remote lateral movement execution via WMI, Windows services, or scheduled tasks on the same host.
Splunk (SPL)
