SNOWLIGHT Fake Windows Update Service (wusvc) Persistence via Registry

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

This rule detects unauthorized modifications to the ImagePath registry value for the Windows Update service (wusvc). By changing this path to a non-standard executable or DLL, an attacker can achieve persistence and elevate privileges by having their code execute when the service starts.