CountLoader Command 5: PowerShell module fetch chained directly into Invoke-Expression

Duo Tech@duotech

•updated Aug 6, 2026•3•0•2

Detects PowerShell processes whose command line chains a main() function call directly into Invoke-Expression, consistent with CountLoader's module-fetch-and-execute pattern used by DOUBLECUP LaaS.