PowerShell removing script/shortcut files from autorun/startup dirs

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•4

Detects the use of PowerShell to delete files with common script or shortcut extensions from directories frequently used for persistence or staging malicious payloads, such as APPDATA, ProgramData, and the Startup folder.