Lightlife RAT Host Profiling via PowerShell System Info Discovery

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

This rule detects PowerShell or CMD processes executing host profiling and system discovery commands (e.g., whoami, hostname, systeminfo) that are initiated by processes linked to the 'lightlife.ps1' script or associated Lightlife RAT activity.