Self-deleting process with additional suspicious indicator (unusual parent, encoded CLI, or temp path) - CountLoader
Detects a process deleting the exact file it was launched from within 10 seconds of starting, combined with at least one additional suspicious indicator (unusual parent process, encoded command line, or temp/user-writable path), consistent with CountLoader's self-deletion behavior.
Microsoft Sentinel (KQL)
