Lightlife RAT Host Profiling via System Info Commands Spawned by PowerShell

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects reconnaissance activity where PowerShell scripts named 'lightlife.ps1' or 'Update.ps1' execute common Windows system information discovery commands such as systeminfo, whoami, hostname, and wmic. This activity is indicative of the Lightlife RAT performing post-exploitation host enumeration.