SNOWLIGHT wusvc Fake Windows Update Service Registration
Detects indicators of the SNOWLIGHT dropper establishing persistence by either creating a malicious Windows service named 'wusvc', modifying the Windows registry to add a service entry for 'wusvc', or executing a 'wusvc.exe' binary from a non-standard file path (outside of System32 or SysWOW64).
Cortex XDR
