AI-"Vibe-Coded" PowerShell Script ("Untitled1.ps1") Used for Active Directory Enumeration and S3 Exfiltration via s5cmd/SharpShares — Threadlinqs Intelligence
As of 2026-07-09, AI-"Vibe-Coded" PowerShell Script ("Untitled1.ps1") Used for Active Directory Enumeration and S3 Exfiltration via s5cmd/SharpShares is a medium-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-1152 · Severity: MEDIUM · Status: ACTIVE · Category: MALWARE
Huntress observed a threat actor pivot via RDP with pre-compromised credentials, deploy an AI-generated ("vibe-coded") PowerShell script (Untitled1.ps1) to exhaustively enumerate Active Directory
On June 3, 2026, Huntress analysts Jevon Ang and Dray Agha identified and fully reconstructed a bespoke PowerShell script — internally titled "Untitled1.ps1" and self-labeled inside its own banner text as "100% Working AD Information Gathering Script - FULLY FIXED" — deployed by a threat actor who had gained RDP access to a victim environment using pre-compromised credentials (consistent with prior VPN/edge-device credential compromise).
The actor staged tooling directly in C:\ProgramData\, a common LOLBin/dual-use staging directory that blends with legitimate application data and frequently evades naive allow-list or reputation-based controls. Untitled1.ps1 was executed first and used a cascading, five-method fallback chain to identify the domain and the primary Domain Controller: DNS-based queries, nltest command invocation, the native ActiveDirectory PowerShell module, environment-variable inspection, and a hardcoded fallback value as a last resort. This degree of redundancy — attempting the same discovery goal five separate ways inside try/catch blocks — is atypical of human-authored tradecraft, where operators generally standardize on one or two proven methods to minimize noise and script size.
Once the DC was identified, the script systematically enumerated and exported the following AD objects to CSV inside a freshly created, timestamped directory (C:\AD_Reports_<datetime>): AD_Users.csv, AD_Computers.csv, AD_Groups.csv, AD_OUs.csv, AD_Subnets.csv, AD_Trusts.csv, AD_Users_With_Email.csv, AD_Simple_Users.csv, and DNS_Subnets.txt. The script then generated a self-referential HTML success report (AD_Report.html) summarizing the enumeration results, and finally compressed the entire output directory into a single archive for staged exfiltration.
Approximately thirty minutes after the AD enumeration completed, the actor deployed s5cmd.exe — a legitimate, high-performance, open-source command-line utility for interacting with Amazon S3 and S3-compatible object storage — into the same C:\ProgramData\ staging location and used it to transfer the compressed AD reconnaissance archive to an actor-controlled Amazon S3 bucket, entirely off traditional network egress channels that many organizations do not inspect or restrict (a technique previously documented by Huntress as a broader LOLBin exfiltration TTP and separately observed in Agenda/Qilin ransomware intrusions, where s5cmd was used to stage and exfiltrate data to cloud object storage ahead of encryption). In parallel, the actor ran SharpShares.exe, a publicly available multithreaded .NET share-enumeration assembly, deliberately filtering out common administrative shares ($C$, ADMIN$, IPC$) to instead surface user-facing and file-server share repositories more likely to contain sensitive data of value.
Huntress did not attribute the intrusion to any named actor or group, and no CVE, malware family, hash, domain, or IP indicator was published with the original advisory — the incident is notable purely for its tradecraft novelty: the first widely reported case of an intrusion using single-use, LLM ("vibe-coded") PowerShell tooling for full-spectrum AD reconnaissance. Huntress's SIEM detected the activity behaviorally, via Microsoft-Windows-PowerShell/Operational Event ID 4104 script-block logging, rather than through file-hash or static signature matching — the analysts explicitly noted the script "has never existed before and will likely never be compiled in this exact configuration again," making it fundamentally resistant to hash-based or YARA-style detection.
Multiple secondary indicators point to AI/LLM generation of the script rather than manual authorship: (1) the script's own title banner reads "100% Working AD Information Gathering Script - FULLY FIXED," language characteristic of iterative prompt-engineering and LLM self-correction cycles rather than deliberate human naming; (2) the script contains an unedited LLM placeholder value (an example/generic server name
Target sectors: cross-sector
Target regions: Unknown
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, MEDIUM, threat intelligence, cybersecurity, T1078, T1133, T1059.001, T1087, T1087.002, T1018, T1482, T1135, T1016, T1069.002
