Snowlight wusvc.exe Hell's Gate Direct Syscall Execution via Windows Service
Detects the execution of the Snowlight dropper (wusvc.exe) masquerading as a Windows Update service. The rule identifies instances where wusvc.exe is spawned by services.exe from an unconventional path, signaling a potential malicious service installation associated with the UNC5221 VSHELL RAT campaign. The payload is known to utilize Hell's Gate/Halo's Gate direct syscall techniques to evade security API hooks.
Sigma
