PEAKLIGHT: Decoding the Stealthy Memory-Only Malware

A Mandiant YARA rule for detecting the PEAKLIGHT PowerShell downloader. The rule matches on multiple PowerShell patterns (file write via [IO.File]::WriteAllBytes, Expand-Archive usage, ZIP handling, TLS12 enforcement, and network download calls) and triggers when at least four specific strings are found in a file under 10KB. This indicates detection logic for an obfuscated downloader that retrieves and extracts payloads from a CDN.