CountLoader custom regex JSON-parser pattern in PowerShell command line or decoded script block

Duo Tech@duotech

•updated Aug 6, 2026•3•0•0

Detects PowerShell or pwsh execution containing a custom regex-based JSON key/value parsing pattern (mimicking CountLoader's manual JSON parsing) in either the raw command line or a base64-decoded encoded command, while excluding legitimate ConvertFrom-Json usage.