SNOWLIGHT PEB Walk — wusvc.exe DLL Enumeration Without Import Table

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•4

Detects instances of the wusvc.exe process being executed and subsequently performing file write or module load operations. This pattern is often used by adversaries to mask malicious activity by masquerading as the legitimate Windows Update service.