SystemBC In-Memory Discovery: Registry, Security SW, and Process Enum

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects various reconnaissance and discovery commands, including process listing, registry queries, and security software enumeration, that are characteristic of the SystemBC malware's in-memory scripting behaviors. The rule identifies suspicious process parent-child relationships, unauthorized registry queries of sensitive security paths, and the use of command-line tools like WMIC, Tasklist, and PowerShell for environment discovery without disk-based script artifacts.