PowerShell deletes .js launcher files from Downloads folder (Veil#Drop cleanup)

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•5

Detects the use of PowerShell to delete .js files located within the 'Downloads' directory. This behavior is commonly associated with cleanup of dropped malicious payloads or script-based malware artifacts.