SNOWLIGHT wusvc.exe Drop in User Profile Followed by Service Install

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects activity associated with the SNOWLIGHT malware, specifically the dropping of a malicious executable named 'wusvc.exe' or 'WindowsUpdate' into user-writable directories (Downloads or AppData), followed by the creation of an automatically starting Windows service that executes the dropped file. This rule correlates process creation/service registration events with SCM event 7045 entries.