UNC5221 SNOWLIGHT wusvc Fake Service Creation Then Outbound TLS C2
Detects the SNOWLIGHT dropper creating a malicious Windows Service masquerading as the legitimate 'Windows Update Service' (wusvc), followed by outbound TLS network connections to non-Microsoft infrastructure within a 2-minute window. This behavior is indicative of C2 communication from a compromised system.
YARA-L
