CountLoader custom regex-based JSON parser bypassing ConvertFrom-Json

Duo Tech@duotech

•updated Aug 4, 2026•3•0•6

Detects PowerShell command lines using CountLoader's distinctive custom regex-based JSON-parsing pattern to strip brackets and build hashtables, avoiding the natively-monitored ConvertFrom-Json cmdlet.