PowerShell terminating scripting/.NET processes (Veil#Drop cleanup)

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•4

Detects PowerShell instances executing 'Stop-Process' against known living-off-the-land binaries (LotLBin) or PowerShell processes explicitly terminating these specific binaries. This behavior is often associated with process hollowing, anti-forensics, or attempts to clear space for malicious code injection by terminating security or system-related tools.