JS.MonoGlyphRAT Run Key Persistence
Detects the creation or modification of a registry value within the HKCU Run key that points to wscript.exe executing a .js file. This is the primary persistence mechanism for JS.MonoGlyphRAT to maintain a foothold on compromised US enterprise systems.
Sigma
