Snowlight Dropper wusvc.exe Dynamic API Resolution via PEB Walking
Detects the execution of the Snowlight dropper (wusvc.exe) and its associated module-load events. The rule identifies attempts to load core Windows modules (ntdll.dll, kernel32.dll, kernelbase.dll) by a process name that does not correspond to any legitimate Windows system component, which is indicative of manual PEB (Process Environment Block) module-list walking and dynamic API function resolution used to evade static analysis.
Sigma
