New cleanmgr indirect execution trick

[miller-itsec]

[bohops]

Thank you for submitting. We apologize for the delay as we get through the backlog.

For this technique, could you please be more specific about the execution of the "dropper script" (e.g. type - batch/powershell/etc) from the modified registry key?