SNOWLIGHT wusvc.exe UAC Bypass via requireAdministrator Manifest

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects the execution of a process named 'wusvc.exe' located outside of the standard C:\Windows\System32 or C:\Windows\SysWOW64 directories. Attackers often rename malicious binaries to look like legitimate system services (such as Windows Update service) to evade detection and maintain persistence.