SNOWLIGHT Fake Windows Update Service (wusvc.exe) Service Registration
Detects potential persistence attempts by the SNOWLIGHT dropper, which masquerades as the legitimate Windows Update service (wusvc). The rule monitors for unauthorized execution of wusvc.exe, the use of sc.exe to register a wusvc service, and direct modification of registry keys associated with the wusvc service path.
SentinelOne
