SNOWLIGHT Security Tool Process Enumeration via wusvc.exe

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects instances of the 'wusvc.exe' process (associated with the Snowlight malware) enumerating known security, analysis, and debugging tools on a compromised host. The rule monitors for the co-occurrence of this process and identified security tool processes within a short timeframe on the same device.