Lightlife RAT ZIP Archive Creation and HTTP POST Exfiltration to C2

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•5

This rule detects potential data exfiltration activity where PowerShell is used to compress files followed by an outbound network connection to a known C2 IP address and port. It also monitors for direct outbound connections from PowerShell involving suspicious keywords indicative of data staging and exfiltration such as 'Compress-Archive', 'client.zip', and 'UPLOAD'.