Snowlight Dropper AMSI In-Memory Patch via wusvc.exe Loading amsi.dll

Subhankar H@Andrewsec57

•updated Jul 6, 2026•0•0•3

Detects instances where the Windows Update Service (wusvc.exe) loads amsi.dll, a behavior associated with the Snowlight dropper to facilitate in-memory patching of AMSI functions (AmsiScanBuffer, AmsiInitialize, and AmsiOpenSession) and bypass security scanning.