Attackers Use AI‑Generated PowerShell to Scan AD

A recent incident revealed that an unknown threat actor leveraged a “vibe-coded” PowerShell script designed to perform Active Directory (AD) enumeration. The script first searched for Domain Controllers (DCs), then mapped users, computers and domains before creating a directory and exporting several files. Finally, it generated an `AD_Report.html` file summarizing its findings.¹

The use of obfuscation techniques—referred to as “vibe code”—mirrors methods seen in older malware such as Stuxnet, making reverse engineering more difficult. AD reconnaissance is a standard step attackers take before attempting lateral movement or privilege escalation; tools like BloodHound are often employed afterward to locate high-value targets within the network.

Expert analysis notes that while modern large language models can accelerate initial reconnaissance phases, they also introduce risks of hallucination. Nonfunctional segments may appear in auto‑generated scripts, requiring manual correction or editing after generation.

The attack illustrates a broader trend where AI assistance lowers barriers for less experienced adversaries by automating tasks previously demanding deep domain knowledge. Similar incidents have been reported earlier this year when ransomware groups used ChatGPT to craft phishing emails or obfuscated malware code. Regulators—including CISA—are expected to issue updated guidance on verifying script provenance soon.