JS.MonoGlyphRAT and Remcos RAT execution via wscript/cscript from EvilTokens phishing

Ibrahim Saud@tektrix

•updated Jun 24, 2026•2•0•3

This rule detects various activities associated with the Remcos Remote Access Trojan (RAT). It identifies the execution of JavaScript payloads (potentially MonoGlyphRAT) via script hosts (wscript.exe, cscript.exe), direct execution of 'remcos.exe', 'cmd.exe /c' spawned by 'remcos.exe' indicating C2 shell activity, and the creation of registry keys for Remcos persistence.