CountLoader C2 beaconing via /connect Bearer JWT followed by getUpdates polling
Detects CountLoader's C2 beacon sequence: an HTTP GET to /connect carrying XOR-hex-encoded host telemetry and a Bearer token, followed within an hour by a JWT-authenticated getUpdates POST from the same host/destination pair.
Microsoft Sentinel (KQL)
