UNC5221 SNOWLIGHT Direct Syscall EDR Bypass with RWX Memory and LSASS Access
Detects behavior indicative of the SNOWLIGHT dropper, which uses direct syscalls to perform memory allocation (VirtualAlloc/VirtualProtect with PAGE_EXECUTE_READWRITE) and subsequent process access to LSASS or other critical security processes (MsMpEng.exe, csrss.exe, winlogon.exe). The detection specifically looks for the absence of ntdll.dll in the call stack during these operations, signaling an EDR bypass attempt via direct syscalls within a 60-second window.
YARA-L
