UNC5221 SNOWLIGHT Dropper Masquerading as Windows Update Service (wusvc.exe)

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects the SNOWLIGHT dropper (UNC5221) masquerading as the Windows Update service (wusvc.exe). It monitors for the creation of a Windows service named 'wusvc' or 'Windows Update Service' located outside of standard system directories, and the execution of 'wusvc.exe' from user-writable directories like AppData, Temp, or Downloads, indicating potential malicious persistence or dropper activity.