Correlated encoded PowerShell launch + reflective .NET load/ScriptBlock in same process lineage (DOUBLECUP/CountLoader)
This rule detects malicious activity associated with the DOUBLECUP/CountLoader malware by correlating specific PowerShell execution patterns within a single process lineage. It flags process sequences where an encoded PowerShell command (using -enc or -encodedcommand) occurs in conjunction with suspicious .NET reflection (System.Reflection.Assembly) or ScriptBlock invocation within a 5-minute window. The rule explicitly excludes processes with valid digital signatures to reduce false positives from legitimate administrative software.
Cortex XDR
