SNOWLIGHT Security Tool Process Enumeration Blacklist Check (T1622)

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects the SNOWLIGHT dropper attempting to detect analysis or security tools by rapidly enumerating common debugging, profiling, and analysis executables (such as x64dbg, IDA Pro, Wireshark, Process Hacker, etc.). The rule triggers when a single process queries at least 3 distinct blacklisted tool names more than 5 times within a 1-minute window, a characteristic behavior used to identify and evade analysis environments.