SNOWLIGHT Direct Syscall ntdll Hook Bypass via wusvc.exe and RWX Memory

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects the loading of ntdll.dll or amsi.dll by the Windows Update Service (wusvc.exe). This pattern is often observed in the context of advanced techniques like SNOWLIGHT, which uses direct syscall table enumeration to bypass security controls. Monitoring for these modules in this specific process context can indicate memory-resident malicious activity or evasion attempts.