CountLoader host-profiling recon: correlated wallet/Signal folder checks and AV WMI enumeration from same process
Detects host-profiling reconnaissance behavior characteristic of the CountLoader malware, where a process concurrently checks for common cryptocurrency wallet and Signal messaging application data folders alongside performing WMI-based antivirus product enumeration within a 5-minute window.
Cortex XDR
