VEIL#DROP PowerShell Terminating wscript.exe to Reduce Forensic Trail

Ethan Andrews@eandrews

•updated Jul 1, 2026•2•0•9

Detects the use of PowerShell to forcefully terminate 'wscript.exe' using 'Stop-Process' or 'taskkill'. This behavior is associated with adversaries, such as those in the VEIL#DROP campaign, attempting to minimize forensic evidence after executing malicious JavaScript lures via Windows Script Host.