SNOWLIGHT wusvc.exe sandbox evasion via PEB environment string inspection
Detects the execution of wusvc.exe (Windows Update Service) from suspicious file paths or when associated with user, host, or directory names containing keywords like 'sandbox', 'malware', 'virus', or 'sample'. This behavior is indicative of potential masquerading or the analysis of malicious samples.
Splunk (SPL)
