SNOWLIGHT wusvc.exe UAC Elevation via requireAdministrator Manifest

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects the execution of a malicious file named wusvc.exe, known as the SNOWLIGHT dropper, which masquerades as the legitimate Windows Update Service. The rule identifies instances where this file is run from suspicious locations (e.g., Downloads folder) or triggers UAC elevation despite not being associated with recognized Windows update processes.