WScript WMI Host Profiling
Detects wscript.exe executing WMI queries targeting specific Win32 classes (such as Win32_SystemEnclosure, Win32_VideoController, etc.) to profile the host system. This behavior is associated with JS.MonoGlyphRAT, which extensively profiles systems before deploying secondary payloads.
Sigma
