CountLoader LOLBin masquerading as pOneDrive/cOneDrive/mOneDrive (tightened)
Detects CountLoader copying conhost.exe, powershell.exe, and mshta.exe into user-writable directories with p/c/m OneDrive-style name prefixes and patched PE metadata (OriginalFileName), running outside standard system directories.
Microsoft Sentinel (KQL)
