CountLoader in-memory PowerShell module execution via download-then-Invoke-Expression and main() call

Duo Tech@duotech

•updated Aug 4, 2026•3•0•3

Detects CountLoader's taskType 5 command dispatch: a PowerShell script block that downloads content (Invoke-WebRequest/DownloadString) then pipes it to Invoke-Expression with a subsequent main() function call, consistent with fetched reconnaissance modules executed in memory.