CountLoader c/p/mOneDrive binary with PE metadata mismatch in user-writable path
Detects the creation, rename, or modification of potential CountLoader malicious binaries masquerading as OneDrive executables (ponedrive.exe, conedrive.exe, monedrive.exe). The rule identifies these by looking for execution in user-writable directories combined with PE metadata mismatches (Original Filename or File Description) that do not align with legitimate OneDrive binaries.
Cortex XDR
