Lightlife RAT - Encoded PowerShell Spawned from mshta.exe/wscript.exe Loader

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects instances of PowerShell being launched by common scripting host binaries (mshta.exe, wscript.exe, cscript.exe) with command-line arguments indicative of malicious activity, such as encoded commands, hidden windows, and remote code download patterns (e.g., iex, Invoke-RestMethod). The rule further checks for indicators related to the Lightlife C2 infrastructure.