SNOWLIGHT Anti-Analysis Tool Enumeration via wusvc.exe Process Access

Ibrahim Saud@tektrix

•updated Jun 28, 2026•1•0•1

This rule detects instances of the SNOWLIGHT dropper (wusvc.exe) initiating or interacting with processes identified as common debugger or system analysis tools. The rule monitors for the simultaneous presence of wusvc.exe and a blacklist of tools like processhacker.exe, ida.exe, and wireshark.exe within a 120-second window on the same device.