Snowlight Dropper Analysis Tool Process Enumeration via wusvc.exe (UNC5221)
Detects the Snowlight dropper (wusvc.exe) attempting to open handles to known security analysis, debugging, and monitoring tools. This activity is a form of analyst environment detection used by the malware to identify if it is being executed within a research or sandbox environment before proceeding with further malicious actions.
Sigma
