CountLoader mshta.exe chain execution with remote URL via mshta lineage
Detects a process chain where mshta.exe is spawned by and descends from mshta.exe, executing a command line referencing a remote HTTP/HTTPS URL, consistent with CountLoader delivery observed in DOUBLECUP LaaS ClickFix campaigns.
Cortex XDR
