macOS LaunchAgent plist write by non-standard process correlated with launchctl load
Detects a LaunchAgent plist written to ~/Library/LaunchAgents/ by a non-installer process, correlated with a launchctl load referencing an unsigned/ad hoc binary path within 15 minutes, consistent with the CountLoader macOS variant's persistence mechanism.
Microsoft Sentinel (KQL)
