SNOWLIGHT Anti-Analysis - verifier.dll Debugger Check and Security Tool Enumeration (T1622)

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects the SNOWLIGHT dropper (associated with UNC5221) attempting to evade analysis. The rule monitors for the loading of 'verifier.dll' by the suspicious 'wusvc.exe' process (a common disguise for this malware) as a mechanism to perform debugger checks, alongside the enumeration of various security and analysis tools (e.g., debuggers, packet sniffers, and virtualization tools).