CountLoader taskType 3: rundll32.exe execution of recently-downloaded DLL from user profile
Detects rundll32.exe executing a DLL that was written to a user-profile/AppData path within the preceding 15 minutes, consistent with CountLoader's taskType 3 command dispatch downloading and invoking an attacker-specified exported function.
Microsoft Sentinel (KQL)
