CountLoader mshta.exe execution with remote URL (taskType 10)
Detects mshta.exe invoked with a remote HTTP(S) URL argument, consistent with CountLoader's taskType 10 command proxying malicious script execution through mshta.exe, excluding local file/HTA paths.
Microsoft Sentinel (KQL)
