SNOWLIGHT Direct Syscall EDR Bypass via wusvc.exe with VirtualProtect/VirtualQuery

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects execution and suspicious memory operations by 'wusvc.exe', a known dropper for the SNOWLIGHT malware. The rule monitors for direct syscalls (NtAllocateVirtualMemory, NtProtectVirtualMemory) and remote thread injection attempts (CreateRemoteThread, QueueUserApc) typical of evasion techniques used to bypass EDR hooks and execute payloads. It further filters for anomalies based on execution path (e.g., Temp, Downloads) or specific process file hashes.