SNOWLIGHT wusvc.exe Dropper Executing from User Profile Path (T1036.004)

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects instances where a process named wusvc.exe is executed from suspicious directories (such as Downloads, AppData, Temp, or Public folders) instead of the legitimate Windows system directories (System32 or SysWOW64). It further restricts the scope to processes spawned by common user applications like web browsers or explorer.exe, indicating potential masquerading or execution of malicious binaries disguised as the Windows Update service.