SNOWLIGHT wusvc.exe Masquerading as Windows Update Service
Detects the execution of wusvc.exe (Windows Update service) from non-standard locations, specifically the user Downloads folder or locations other than the authorized C:\Windows\System32\ directory. This pattern is commonly used to masquerade malicious payloads as legitimate system services.
Cortex XDR
