JS.MonoGlyphRAT PowerShell Staging

Ethan Andrews@eandrews

•updated Jun 2, 2026•7•0•7

Identifies wscript.exe executing a JavaScript file from a user directory and subsequently spawning a PowerShell process with execution policy bypass (-nop) and encoded command (-enc) flags, indicative of potential MonoGlyphRAT staging activity.