CountLoader PowerShell module fetch chained with Invoke-Expression and main() call (taskType 5)

Duo Tech@duotech

•updated Aug 6, 2026•4•1•11

Detects PowerShell command lines that fetch a remote module using methods like DownloadString or Invoke-WebRequest, subsequently executing the downloaded code in-memory via Invoke-Expression (iex), and finally invoking a main() function. This pattern matches the execution chain used by the CountLoader malware (taskType 5).