JScript Dropper File Self-Deletion via wscript.exe After Timeout

Duo Tech@duotech

•updated Jun 30, 2026•0•0•1

Detects instances where wscript.exe deletes PowerShell files (.ps1) from the C:\Temp directory. This pattern is commonly associated with JScript droppers and malicious scripts performing post-execution cleanup to remove forensic artifacts after a timeout period.