SNOWLIGHT Dynamic advapi32.dll Load and GetUserNameA Resolution
Detects the Windows Update service (wusvc.exe) loading the advapi32.dll library. While advapi32.dll is a standard Windows component, unauthorized or unexpected library loading by system processes can be an indicator of DLL side-loading, process injection, or other hijacking techniques used to execute malicious code within a trusted context.
Cortex XDR
