VEIL#DROP PowerShell Security Bypass Flags via wscript.exe

Ethan Andrews@eandrews

•updated Jul 1, 2026•1•0•10

Detects the execution of PowerShell with security-bypassing flags (-ExecutionPolicy Bypass, -NoProfile, -WindowStyle Hidden) launched by the Windows Script Host (wscript.exe). This pattern is associated with the VEIL#DROP campaign where JavaScript lures invoke PowerShell to bypass AMSI and security controls.