SNOWLIGHT wusvc.exe AVX-512 Encrypted C2 Channel on Port 8084 (T1573)

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•4

Detects the SNOWLIGHT dropper (disguised as the Windows Update Service 'wusvc.exe') attempting to establish an outbound network connection to a known malicious C2 infrastructure (38.60.253.35) on port 8084. The rule also accounts for the use of non-standard port communication and monitors for suspicious process masquerading outside of protected system directories.