SNOWLIGHT Debugger Tool Process Enumeration via 16-Tool Blacklist

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

This rule detects the execution of common security analysis, debugging, and forensic tools such as x64dbg, IDA Pro, Wireshark, and Process Hacker. These tools are often used by adversaries for reverse engineering, malware analysis, or to gain deeper insight into a compromised host environment.