Attacker Uses Suspected AI-Generated PowerShell Script to Map Active Directory
A threat actor leveraged an AI-generated PowerShell script to aggressively map an Active Directory environment, culminating in data exfiltration and a detailed inventory report. The attack chain, utilizing tools like s5cmd and SharpShares, mirrored a traditional ‘smash-and-grab’ approach but was significantly accelerated by AI assistance, lowering the barrier to entry for cybercrime and enabling faster, more aggressive campaigns. The incident highlights a growing trend of AI being used to augment existing attack techniques, rather than introducing entirely new malware.
A threat actor utilized an AI-generated PowerShell script to conduct a highly aggressive Active Directory enumeration campaign, resulting in data theft and a comprehensive inventory report. The attack chain began with establishing Remote Desktop Protocol (RDP) access onto a domain-joined Windows Server, followed by staging tools in the "C:\ProgramData\" folder. The incident occurred in early June 2026.
This involved a bespoke PowerShell script, titled "100% Working AD Information Gathering Script - FULLY FIXED," which the researchers at Huntress described as "highly aggressive" and "noisy." The script was created with assistance from a large language model (LLM), and exhibited telltale signs such as prompt iteration titles, placeholder strings, and over-engineered code designed to locate a Domain Controller. The script employed a "five-step cascading fallback mechanism" to enable reconnaissance and discovery.
Once a Domain Controller was identified, the attacker initiated a data collection routine, systematically harvesting AD users, computers, groups, organizational units (OUs), and trusts, and storing the details in a staging directory. Approximately 30 minutes later, the attacker deployed s5cmd, a legitimate tool for bulk file operations, and SharpShares, a C#-based network shares enumeration utility, to locate user-accessible data repositories.
Finally, the collected data was converted into CSV files, archived, and exfiltrated to a remote server, before an HTML file summarizing the data theft was created – an "active directory inventory report." Huntress researchers noted that the AI assistance likely involved a "helpful inject" from the LLM, rather than intentional authoring of the script.
The incident underscores a growing trend of threat actors leveraging AI to accelerate and enhance traditional attack methods. Sygnia reported a similar AI-assisted cloud attack that progressed from initial access to broad compromise within 72 hours against an AWS environment, driven by a financially motivated attacker who repeatedly leveraged newly acquired credentials to restart discovery, secrets harvesting, persistence, and impact activities. The attacker exploited a single misconfiguration to gain access, then chained weaknesses across various cloud resources, rapidly executing credential discovery, secrets harvesting, cloud enumeration, deployment-pipeline abuse, runtime modification, database access, and operational disruption.
Notably, the attacker didn't introduce novel malware, but rather reduced the time and effort required to operationalize established adversary behaviors, repeatedly converting newly obtained access into tailored actions and leveraging permissions to maximize impact.