CountLoader AV discovery via WMI SecurityCenter2 correlated with encoded PowerShell
Detects a WMI query against root\SecurityCenter2 AntiVirusProduct for displayName, correlated with an encoded PowerShell execution (-enc/-EncodedCommand/-e) from the same process chain within 10 minutes, consistent with CountLoader's AV-discovery step.
Microsoft Sentinel (KQL)
