WScript Non-Standard Port C2
Detects wscript.exe initiating outbound network connections to non-standard HTTP ports (ports other than 80, 443, or 8080), which aligns with JS.MonoGlyphRAT's C2 communication profile. This rule specifically looks for successful network connections from wscript.exe to remote IPs that are not private and are not using standard web ports, indicating potential command and control activity.
Microsoft Sentinel (KQL)
