WScript-driven deletion of staged ZIP/Evernote archive under Public folder
Detects instances where wscript.exe deletes a .zip archive from within the C:\Users\Public\ directory structure. This activity is frequently associated with VBScript droppers performing anti-forensic cleanup by removing staged payloads after extraction but prior to execution.
Microsoft Sentinel (KQL)
