JS.MonoGlyphRAT Run Key Persistence
Detects the creation or modification of a registry value within the Run key that points to wscript.exe executing a .js file, which is a primary persistence mechanism for JS.MonoGlyphRAT. The rule specifically looks for modifications to user-level Run keys and checks for 'wscript.exe' and '.js' within the RegistryValueData, accounting for potential additional arguments after the .js file path.
Microsoft Sentinel (KQL)
