Snowlight Dropper Fake Windows Update Service Registration via wusvc.exe

Subhankar H@Andrewsec57

•updated Jul 6, 2026•3•0•7

Detects the Snowlight dropper (UNC5221) installing a new Windows service named 'Windows Update Service' that utilizes a non-standard executable file named 'wusvc.exe' to achieve persistence and masquerade as the legitimate Windows Update service (wuauserv).