SNOWLIGHT wusvc.exe loading advapi32.dll and resolving GetUserNameA via GetProcAddress
Detects the Windows Update Service (wusvc.exe) loading advapi32.dll or performing suspicious API calls like GetProcAddress to resolve GetUserNameA. This behavior is atypical for the legitimate Windows Update service and may indicate process injection, credential harvesting, or tampering attempts.
Splunk (SPL)
