SNOWLIGHT Sandbox String Detection via wusvc.exe Process Path or Name
Detects the Windows Update service (wusvc.exe) or any process with environment strings (command line or folder path) containing sandbox-related keywords such as 'sandbox', 'malware', 'virus', or 'sample'. This behavior is characteristic of malware attempting to detect if it is running within an analysis, sandbox, or virtual machine environment.
Microsoft Sentinel (KQL)
