SNOWLIGHT UNC5221 Direct Syscall EDR Evasion via Manual ntdll Mapping

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

This rule detects EDR evasion techniques associated with the SNOWLIGHT dropper used by UNC5221. It identifies two specific behaviors: the manual loading of ntdll.dll from non-standard Windows directories, which suggests an attempt to bypass EDR hooks through manual mapping and direct syscalls, and the loading of amsi.dll by processes running from user-writable directories (e.g., Temp, Downloads), indicative of an in-memory AMSI bypass.