Suspected AI-Generated ("Vibe-Coded") PowerShell Script Used to Map Active Directory Post-RDP Compromise — Threadlinqs Intelligence
As of 2026-07-13, Suspected AI-Generated ("Vibe-Coded") PowerShell Script Used to Map Active Directory Post-RDP Compromise is a medium-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 21 indicators of compromise.
Threat ID: TL-2026-1281 · Severity: MEDIUM · Status: ACTIVE · Category: MALWARE
A financially motivated threat actor used pre-compromised credentials to gain RDP access to a domain-joined Windows Server, then deployed a suspected AI-generated ("vibe-coded") PowerShell script,
On June 3, 2026, Huntress incident responders identified an intrusion against a domain-joined Windows Server in which an unidentified, likely financially motivated threat actor used pre-compromised credentials to establish a Remote Desktop Protocol (RDP) session. After staging tools in C:\ProgramData, the actor deployed a PowerShell script named Untitled1.ps1 within minutes of gaining access. The script bore multiple hallmarks of AI/LLM ("vibe-coded") generation: an internal title of "100% Working AD Information Gathering Script - FULLY FIXED" consistent with iterative prompt refinement, an unedited placeholder hostname ("Server1.HR.local") left inside its Domain Controller discovery fallback logic, five redundant and cascading DC-discovery methods (DNS query, nltest, Active Directory PowerShell module, environment-variable inspection, and a hardcoded fallback) where one or two would normally suffice, heavily repetitive boilerplate try/catch error handling, and excessive, unnecessary colorized Write-Host console output (cyan, green, red, yellow).
The script systematically enumerated Active Directory users (in standard, email-enabled, and simplified formats), computers, groups, organizational units, domain trusts, and DNS-derived subnets, writing each category to CSV, generating an HTML summary report (AD_Report.html), and compressing all output into a timestamped ZIP archive under a directory named C:\AD_Reports_<datetime>. Approximately 30 minutes after the initial PowerShell-based enumeration, the actor deployed two additional, legitimate tools: s5cmd.exe (a high-performance, open-source Amazon S3 command-line utility, here abused for bulk exfiltration to attacker-controlled cloud storage rather than its intended AWS use case) and SharpShares.exe (an open-source, multithreaded C#/.NET assembly, github.com/mitchmoser/SharpShares, used to enumerate domain-accessible network shares and identify further data repositories for exfiltration).
Huntress researchers reconstructed the full script contents from Windows Event ID 4104 (PowerShell Script Block Logging) telemetry in the PowerShell Operational event log, since the script itself was deleted or otherwise unavailable for direct recovery, and noted that because the script was functionally unique to this intrusion, traditional hash- and signature-based antivirus detection was ineffective; detection instead relied on behavioral telemetry (sequential AD module calls, unusual CSV/ZIP creation in ProgramData, and abnormal PowerShell script-block volume). The case, publicly reported by Huntress and covered by The Hacker News, Cybersecurity News, Infosecurity Magazine, IT Security Guru, and Cyberpress on and around July 8, 2026, is notable not for a novel exploitation technique or CVE, but because it demonstrates that generative-AI/LLM assistance is measurably lowering the skill barrier and execution time for attackers to conduct competent Active Directory reconnaissance and share-based data theft, a trend separately highlighted in industry reporting on AI-enabled attacker speed and scale.
Target sectors: unspecified
Target regions: Unknown
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 21 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, MEDIUM, threat intelligence, cybersecurity, T1078, T1133, T1059, T1087, T1087.002, T1018, T1135, T1482, T1016, T1010