CountLoader wallet/Ledger/Signal folder recon correlated with WMI AV discovery
Detects folder-existence checks for Ledger Live/Wallet, cryptocurrency wallet directories (atomic, Exodus, Guarda, KeepKey, BitBox02), and Signal Desktop under %APPDATA%, correlated with a WMI AV-discovery query from the same process within 15 minutes, consistent with CountLoader's crypto-wallet reconnaissance.
Microsoft Sentinel (KQL)
