SNOWLIGHT RWX Memory Allocation and APC Injection for VSHELL RAT Delivery
This rule detects instances where the Windows Update service (wusvc.exe) loads a module or file while simultaneously initiating a process. This behavior is often associated with process injection or the misuse of legitimate system binaries (LOLBins) to facilitate malicious activities by proxying execution through trusted services.
Cortex XDR
