SNOWLIGHT Sandbox Detection via Keyword String Matching in Process Context
Detects potential SNOWLIGHT dropper behavior where a process associated with Windows Update (wusvc.exe) is observed alongside environment naming conventions indicative of analysis sandboxes (e.g., 'malware', 'sandbox', 'virus', 'sample'). This combination of process naming and environment characterization suggests evasion or anti-analysis techniques typical of malware droppers.
SentinelOne
