CountLoader chain: silent msiexec /i /quiet /qn against recently-written MSI

Duo Tech@duotech

•updated Aug 6, 2026•3•0•5

Detects msiexec.exe executed with silent installation flags (/i /quiet /qn) targeting an MSI file that was written to disk within the preceding 15 minutes, consistent with the CountLoader delivery chain associated with DOUBLECUP.