T1070.004: Veil#Drop Script and Shortcut Cleanup from Persistence Paths

Tim Peck@timpeck

•updated Jul 1, 2026•3•0•19

Detects adversary cleanup activities where PowerShell is used to remove script files and shortcuts (.lnk, .js, .bat, .vbs) from common persistence and startup directories (APPDATA, PUBLIC, ProgramData, and Startup folder), often associated with Veil#Drop anti-forensic techniques.