AI-Generated PowerShell Script Shows a New Risk for Active Directory Environments

Huntress published an analysis of a real incident in which a threat actor used an AI-generated PowerShell script to enumerate an Active Directory environment. The script, identified as Untitled1.ps1, was used after the attacker established RDP (Remote Desktop Protocol) access to a domain-joined Windows Server.

The case matters not because the attack introduces an entirely new technique. Active Directory reconnaissance, accessible share discovery and preparation for data exfiltration are familiar stages in many intrusions. The difference is how the tool was created — through AI-assisted code generation.

This creates a practical risk for defensive teams: attackers can quickly generate custom scripts for a specific environment instead of relying only on known tools that already have signatures, indicators and detections.

What Happened

According to Huntress, the attack began with RDP access to a Windows Server joined to the domain. The incident context suggested the use of pre-compromised credentials.

After gaining access, the attacker staged tools in C:\ProgramData, a commonly abused location for temporary tooling in Windows intrusions. Within minutes, the attacker executed the PowerShell script Untitled1.ps1, whose purpose was Active Directory reconnaissance.

The script collected information about:

• users;
• computers;
• groups;
• organizational units;
• subnets;
• domain controllers;
• domain trust relationships;
• the structure of the environment.

The results were exported into files, and an HTML report was generated to summarize the collected data. Later in the attack, the actor used s5cmd.exe, a legitimate Amazon S3 command-line tool that can be abused for data exfiltration. The attacker also used SharpShares.exe to identify accessible network shares while filtering out standard administrative shares.

What “Vibe-Coded” Means in This Context

“Vibe-coded” refers to code created by iteratively prompting an AI model in natural language. Instead of manually writing the full script, the attacker can describe what the tool should do, receive code, request fixes and repeat the process until the result works.

In this case, Huntress highlighted several indicators that the script was generated or heavily assisted by AI:

• a title resembling “100% Working AD Information Gathering Script – FULLY FIXED”;
• overly complex domain controller discovery logic;
• an unchanged example hostname;
• excessive colorful console output;
• several fallback methods for the same task instead of a more concise approach.

These signs are not proof in every case on their own, but together with the script behavior they reflect a pattern often seen in AI-generated code: functional, but verbose, repetitive and not fully tailored to the real environment.

Why Active Directory Remains a Core Target

Active Directory is central to identity and access in many enterprise environments. If an attacker understands the domain structure, groups, users, administrative roles and trust relationships, they gain a map of the environment.

Active Directory reconnaissance can support:

• identification of privileged accounts;
• discovery of administrative groups;
• mapping of servers and workstations;
• discovery of accessible network shares;
• planning of lateral movement;
• preparation for data theft;
• selection of the next target inside the network.

This type of script should therefore not be treated as “only information gathering.” Reconnaissance is often the stage that allows the attack to become more precise, faster and more damaging.

Why This Challenges Traditional Detection

Traditional security tools often rely on known file hashes, static signatures, tool names or recurring indicators. This works well when attackers use common frameworks or tools that have already been seen in other campaigns.

AI-generated scripts change that logic. A script can be created for one specific intrusion and may never appear again in the same form. This reduces the value of detection based only on file name, hash or exact text.

The behavior, however, remains observable. Even if the code is new, it still needs to perform certain actions:

• execute PowerShell commands;
• communicate with a domain controller;
• query users, groups and computers;
• create output files;
• archive or stage data;
• enumerate network shares;
• run additional tools.

This is why behavioral telemetry becomes more important. AI can change syntax, but it cannot fully hide the operational footprint required to enumerate Active Directory.

What Should Be Monitored

Organizations with Windows and Active Directory environments should monitor not only known tools, but also behavior that indicates reconnaissance.

Important data sources include:

• PowerShell Operational logs;
• Event ID 4104 for PowerShell script block logging;
• RDP logon events;
• unusual interactive sessions to servers;
• PowerShell execution by atypical users;
• file creation in C:\ProgramData;
• bulk extraction of users, groups and computers;
• domain controller queries from unusual hosts;
• creation of CSV, HTML or ZIP files containing inventory data;
• tools used to identify accessible shares;
• legitimate data transfer tools used in suspicious contexts;
• links between AD reconnaissance and later activity toward file servers or cloud storage.

Context is critical. A single PowerShell command may be legitimate. The combination of RDP access, PowerShell reconnaissance, report generation, archiving and preparation for transfer is a different signal.

Recommended Actions

Organizations should treat this type of activity as a risk to identities and internal network structure, not only as PowerShell execution.

Priority actions include:

• enable PowerShell script block logging;
• collect and correlate PowerShell Operational logs;
• monitor Event ID 4104 for unusual scripts;
• restrict RDP access to servers;
• enforce MFA (Multi-Factor Authentication) for remote access;
• apply least privilege for domain accounts;
• restrict local administrative rights;
• monitor bulk AD reconnaissance;
• detect creation of .csv, .html and .zip files containing domain information;
• review activity in C:\ProgramData;
• analyze access to network shares after suspicious AD activity;
• restrict PowerShell where it is not required;
• check whether EDR and SIEM detections identify behavior, not only known tools;
• build response playbooks for AD enumeration.

If a compromised RDP session is suspected, the review should not stop at the affected server. Domain activity after the session should be checked: group access, file shares, cloud services, created files, new tools and possible data exfiltration attempts.

DIAMATIX Perspective

The case shows how AI changes attacker operations at a practical level. An attack does not need to be entirely new to become harder to detect. It is enough for the tool to be customized, single-use and different from known signatures.

For organizations, this means Active Directory protection cannot rely only on lists of known tools. Visibility is required into behavior: who logs in through RDP, which PowerShell commands run, which queries are made to domain controllers, which files are created and what happens after initial reconnaissance.

For cybersecurity providers, this raises the bar for analysis. SOC (Security Operations Center) and MDR (Managed Detection and Response) teams must recognize attacker logic even when the tool is new. With AI-generated scripts, the file name may mean little. The behavior matters more.

DIAMATIX treats cases like this as a signal for more mature behavioral detection. This includes correlation between identity activity, endpoint telemetry, PowerShell logs, RDP access, file changes and network activity.

In regulated sectors, this risk is especially important. Active Directory often controls access to critical systems, shared files, business applications and administrative functions. If an attacker gains a clear map of the domain, the next steps may become faster and more targeted.

AI does not change the attacker’s core objective. It accelerates the creation of tools tailored to a specific target. Defence needs to respond with better telemetry, clearer response playbooks and analysis that looks beyond the file name.

CISO Analysis

For CISOs, this case raises several governance and technical questions.

The first area is Active Directory protection. If the AD environment is not monitored well enough, an attacker may complete reconnaissance without being flagged as high-risk behavior.

Key questions include:

• Do we have visibility into AD enumeration activity?
• Do we monitor who queries domain controllers?
• Can we detect bulk extraction of users, groups and computers?
• Do we have a baseline for normal PowerShell behavior?
• Can the SOC distinguish an administrative script from suspicious reconnaissance?
• How is activity after RDP access to a domain server reviewed?

The second area is reliance on signatures. AI-generated scripts may be different in every attack. This reduces the value of defence that mainly relies on static recognition.

Key questions include:

• Are detections based only on known tools and hashes?
• Do we have behavioral rules for Active Directory reconnaissance?
• Do we monitor PowerShell script block logging?
• Do we correlate RDP, PowerShell, file changes and network activity?
• Can we detect preparation for data exfiltration after reconnaissance?

The third area is remote access governance. In the described incident, the entry point was RDP with compromised credentials. This puts focus on access control, MFA, privileged access and restrictions on interactive sessions.

Key questions include:

• Which servers allow RDP access?
• Which users can log in interactively to servers?
• Is MFA enforced for remote access?
• Are separate administrative accounts used for privileged actions?
• Are failed and successful RDP sessions reviewed?
• Is there an alert for RDP access to unusual servers or at unusual times?

The fourth area is SOC/MDR partner readiness. If the organization uses an external provider, that provider should be able to analyze behavior, not only indicators.

Key questions include:

• Can the provider analyze PowerShell Event ID 4104?
• Are there correlations for AD enumeration?
• How is suspicious but “legitimate-looking” PowerShell activity escalated?
• How does the provider distinguish administrative inventory scripts from attacker reconnaissance?
• How is follow-up review documented when AD compromise is suspected?

The fifth area is response. An AD enumeration incident should not be closed by removing the script alone. Teams need to check what was accessed, which accounts were used, whether shares were enumerated and whether data exfiltration preparation began.

For CISOs, the operational takeaway is that AI-generated tooling reduces the predictability of file-based indicators. Control needs to move toward behavior, context and rapid review of follow-on actions.

What This Means for Your Environment

• This type of risk relies on compromised credentials, remote access, PowerShell execution and Active Directory reconnaissance.
• Detection depends on visibility into RDP sessions, PowerShell logs, Event ID 4104, domain controller queries, file changes and network share activity.
• Response requires review of the accounts used, analysis of executed scripts, inspection of created files, search for follow-on reconnaissance and assessment of possible data exfiltration preparation.

Key questions to review:

• Do you have visibility into PowerShell script block logging?
• Can your SOC detect AD enumeration even when the tool is new?
• Is RDP access to critical servers restricted?
• Do you monitor bulk extraction of users, groups and computers?
• Do you have a response playbook for suspected Active Directory reconnaissance?
• Do you know what happens after initial RDP access?

Review your visibility into Active Directory and PowerShell activity

DIAMATIX can help review:

• logs and telemetry from Active Directory environments;
• PowerShell logging and Event ID 4104;
• RDP access and privileged sessions;
• behavioral detections for AD enumeration;
• correlation between endpoint, identity and network activity;
• SOC/MDR readiness for AI-generated tooling.

Request an Active Directory visibility and response review with DIAMATIX.
Trusted · Innovative · Vigilant

Sources

• Huntress. AI-Coded Malware | Analyzing Vibe-Coded AD Enumeration.
• Infosecurity Magazine. Vibe-Coded Malware Caught in Active Directory Attack.
• Mallory. AI-Generated PowerShell Script Used for Active Directory Enumeration.

This article is based on publicly available information as of July 2026.