CountLoader MSEdgeUpdateService fallback task with patched conhost/PowerShell
Detects the MSEdgeUpdateService<GUID> fallback scheduled task that runs a patched conhost.exe (csvchost.exe) headless launch or patched PowerShell (psvchost.exe) to re-fetch CountLoader from C2 every 25 minutes.
Microsoft Sentinel (KQL)
