CountLoader encoded PowerShell + reflective .NET/ScriptBlock in same lineage

Duo Tech@duotech

•updated Aug 6, 2026•3•0•1

Detects PowerShell processes launched with encoded command arguments (-enc/-EncodedCommand) alongside reflective .NET assembly loading or ScriptBlock usage from the same process lineage within a 5-minute window, indicative of CountLoader-style in-memory payload execution.