NTUserName - property in ROOT\Microsoft\SqlServer\ServerEvents\MSSQLSERVER namespace

'https://wutils.com/wmi/
Dim wmiClass, oProperty
Set wmiClass = GetObject( _
 "WINMGMTS:\\.\ROOT\Microsoft\SqlServer\ServerEvents\MSSQLSERVER:" + _
 "AUDIT_SERVER_PRINCIPAL_IMPERSONATION_EVENT")

'get some class property 
Wscript.Echo wmiClass.properties_("NTUserName").Origin 'or other property name, see properties

'Check if the class is singleton
Wscript.Echo wmiClass.Path_.IsSingleton

'Get number of methods in the class
Wscript.Echo wmiClass.Methods_.Count

'List class properties
For Each oProperty In wmiClass.properties_
	'get property name and origin. Property value in the class is null, of course.
	Wscript.Echo oProperty.Name, oProperty.Origin, oProperty.Value
Next 

'https://wutils.com/wmi/
Dim oWMI, Instances, Instance

'Get base WMI object, "." means computer name (local)
Set oWMI = GetObject("WINMGMTS:\\.\ROOT\Microsoft\SqlServer\ServerEvents\MSSQLSERVER")

'Get instances of AUDIT_SERVER_PRINCIPAL_IMPERSONATION_EVENT - all instances of this class and derived classes 
Set Instances = oWMI.InstancesOf("AUDIT_SERVER_PRINCIPAL_IMPERSONATION_EVENT")


'Enumerate instances  
For Each Instance In Instances 
  'Do something with the instance
  Wscript.Echo Instance.NTUserName 'or other property name
Next 'Instance