SNOWLIGHT Registers Fake Windows Update Service (wusvc) for Persistence

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects evidence of the SNOWLIGHT dropper establishing persistence by registering malicious services (e.g., 'wusvc', 'RageService') or executing known malicious binaries (e.g., 'wusvc.exe', 'win_guard_0.exe') via service creation utilities or registry modifications.