Lightlife RAT Startup Folder VBScript Persistence via Telegram_Private_Call_Session.vbs

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

This rule detects potential persistence and execution of suspicious VBScript files ('Telegram_Private_Call_Session.vbs' or 'assurance.vbs'). It monitors for the creation or modification of these files within the Windows Startup folder, their execution via wscript.exe, and the creation of corresponding registry entries to ensure automatic startup.