{"id":288920,"date":"2026-07-13T07:02:00","date_gmt":"2026-07-13T11:02:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/07\/13\/attacker-uses-suspected-ai-generated-powershell-script-to-map-active-directory\/"},"modified":"2026-07-13T09:15:08","modified_gmt":"2026-07-13T13:15:08","slug":"attacker-uses-suspected-ai-generated-powershell-script-to-map-active-directory","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/07\/13\/attacker-uses-suspected-ai-generated-powershell-script-to-map-active-directory\/","title":{"rendered":"Attacker Uses Suspected AI-Generated PowerShell Script to Map Active Directory"},"content":{"rendered":"

Attacker Uses Suspected AI-Generated PowerShell Script to Map Active Directory<\/a><\/p>\n

https:\/\/thehackernews.com\/2026\/07\/attacker-uses-suspected-ai-generated.html<\/a><\/p>\n

Publish Date: 2026-07-13 07:02:00<\/a><\/p>\n

Source Domain: thehackernews.com<\/a><\/p>\n

Cybersecurity researchers have flagged an intrusion in which an unknown threat actor leveraged a vibe-coded PowerShell script for Active Directory (AD) enumeration.<\/p>\n

“The script looked for the Domain Controller (DC) and mapped users, computers, and domains, before creating a directory and exporting out a number of files, and finally creating AD_Report.html to measure the success of the enumeration attempt,” Huntress researchers Jevon Ang and Dray Agha said.<\/p>\n

The attack chain involved the threat actor establishing Remote Desktop Protocol (RDP) access onto a domain-joined Windows Server with a set of pre-compromised credentials, followed by staging the tools in the “C:ProgramData” folder. The incident took place in early June 2026.<\/p>\n

This included an artificial intelligence (AI)-generated payload to map the Active Directory environment. The assessment is based on various telltale signs, such as the prompt iteration title, placeholder strings, over-engineered code that features multiple methods to find a Domain Controller, and beautified console output using cyan, green, red, and yellow.<\/p>\n

Huntress described the bespoke PowerShell script as “highly aggressive” and “noisy,” making use of a “five-step cascading fallback mechanism” to enable reconnaissance and discovery. It’s titled “100% Working AD Information Gathering Script – FULLY FIXED,” suggesting a back-and-forth with a large language model (LLM).<\/p>\n

Once the primary Domain Controller is located, it initiates a data collection routine to systematically harvest AD users, computers, groups, organizational units (OUs), and trusts, and store the details in a staging directory.<\/p>\n

About 30 minutes later, the attacker moved to deploy a s5cmd, a legitimate tool used for bulk file operations, along with SharpShares, a C#-based network shares enumeration utility, to look for user-accessible data repositories.<\/p>\n

In the final stage, the data is said into CSV files, archived, and exfiltrated to a remote server, but not before…<\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Attacker Uses Suspected AI-Generated PowerShell Script to Map Active Directory https:\/\/thehackernews.com\/2026\/07\/attacker-uses-suspected-ai-generated.html Publish Date: 2026-07-13 07:02:00…<\/p>\n","protected":false},"author":1,"featured_media":288921,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh43TJKqVkJoN7Q3donw2FnXp1IrJEr6vvDteFOBCSR-PptAc8fMXXCq07kvKWoDacCHo6gi5-eUoX9mIBHggv-KXsoH31yBi0-_MZBjxYbiYNlhvAu8V_xhjuKHgnQj43x5S2pORBIGONxE_yLZdZOnDCmcjMegQjhwZtHDThg_4nlhZqwSizsMRCfZFQW\/s1600\/ps-ai.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[26,20,24,18,17,34],"class_list":["post-288920","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-ai","tag-artificial-intelligence","tag-cybersecurity","tag-large-language-model","tag-llm","tag-threat-actor"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/288920"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=288920"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/288920\/revisions"}],"predecessor-version":[{"id":288922,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/288920\/revisions\/288922"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/288921"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=288920"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=288920"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=288920"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}