PowerShell reflection load and ScriptBlock creation correlated in same process
Correlates PowerShell in-memory .NET assembly reflection (System.Reflection.Assembly) with ScriptBlock creation in the same process within a 5-minute window, consistent with CountLoader's reflective payload-loading technique.
Microsoft Sentinel (KQL)
