Veil#Drop Loader Terminates Scripting/.NET Processes via Stop-Process

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

Detects the use of PowerShell Stop-Process being used to terminate common scripting and .NET-related processes, a behavior associated with the Veil#Drop loader to clear potential conflicts or interference from legitimate host processes.