AI-Generated PowerShell Script Used for Active Directory Reconnaissance

A threat actor employed an AI-generated PowerShell script to conduct reconnaissance in a compromised Active Directory environment. The attack began with unauthorized access to a domain-joined Windows Server via Remote Desktop Protocol using stolen credentials. The intruder staged tools in the ProgramData directory and executed a script to map users, groups, and domain controllers. The incident was identified during an investigation by Huntress on June 3, 2026. This highlights the increasing use of AI in creating custom, evasive malware. The specific impact on the victim organization remains unclear, but the use of AI tools indicates a sophisticated approach to cyber intrusions. The situation is ongoing as security teams respond to the incident.

Key Points: • An AI-generated PowerShell script was used for Active Directory reconnaissance. • The attacker gained access using stolen credentials via Remote Desktop Protocol. • The incident was discovered during an investigation by Huntress on June 3, 2026.