SystemBC Persistence via Scheduled Task or Run Key with Encrypted C2 Outbound
This rule detects potential persistence mechanisms by monitoring the creation of scheduled tasks using the 'schtasks' utility or modifications to Windows Registry 'Run' keys, specifically targeting suspicious paths (AppData, Temp, or ProgramData). The detection logic correlates these suspicious persistence artifacts with network activity by joining the events with Sysmon Event ID 3 (Network connection) to identify hosts communicating over common C2-associated ports (4000, 4001, 4002, 443) to non-private IP addresses. A risk score is calculated based on the presence of these persistence markers and outbound network connections.
Splunk (SPL)
