UNC5221 SNOWLIGHT Dropper - wusvc.exe Masquerading Outside System32
This rule detects the execution of a process named 'wusvc.exe' that is masquerading as the legitimate Windows Update Service. The detection logic identifies instances where the executable is located outside of the standard Windows System32 or SysWOW64 directories and is not spawned by a legitimate parent process (svchost.exe or services.exe), which is indicative of the SNOWLIGHT dropper associated with the UNC5221 threat actor.
YARA-L
