WScript WMI Host Profiling by MonoGlyphRAT

Ethan Andrews@eandrews

•updated Jun 2, 2026•6•0•13

Detects wscript.exe querying multiple Win32 WMI classes within a short timeframe to gather host telemetry. This behavior aligns with JS.MonoGlyphRAT's pre-payload execution profiling.