SNOWLIGHT wusvc.exe Registered as Fake Windows Update Service
Detects the creation of new Windows services that masquerade as or use names associated with the Windows Update Service (wusvc), specifically looking for service binaries located in suspicious paths or containing 'wusvc.exe' in the name. This pattern often indicates an adversary attempting to establish persistence or masquerade malicious processes as legitimate system services.
Splunk (SPL)
