CountLoader taskType 6: silent msiexec /quiet /qn install of MSI recently written by same causality chain

Duo Tech@duotech

•updated Aug 6, 2026•3•0•8

Detects a silent MSI installation (msiexec.exe with /i, /quiet, and /qn) where the target MSI file was created or written by the same causality chain on the same host within the preceding 60 minutes, consistent with CountLoader/DOUBLECUP payload staging and silent deployment behavior.