AI-Generated PowerShell Script Helps Threat Actor Accelerate Active Directory Reconnaissance

Artificial intelligence is increasingly becoming an operational advantage for cybercriminals, and a newly documented intrusion demonstrates how attackers are using AI-generated code to speed up familiar attack techniques rather than invent new ones.

Researchers at Huntress uncovered an intrusion in which an unidentified threat actor deployed what appears to be a large language model-generated PowerShell script to perform extensive Active Directory reconnaissance after gaining access to a Windows Server through compromised Remote Desktop Protocol credentials.

The incident, observed in early June 2026, began after the attacker logged into a domain-joined server using stolen credentials. From there, they staged multiple tools inside the Windows ProgramData directory before launching a PowerShell script designed to inventory the victim's Active Directory environment.

According to Huntress, several characteristics strongly indicate the script was produced or refined with AI assistance. Researchers noted placeholder text, prompt-style naming conventions, redundant code designed to accomplish the same task through multiple methods, colorful console output, and a title reading "100% Working AD Information Gathering Script - FULLY FIXED," suggesting repeated interactions with an AI coding assistant.

Once executed, the script systematically collected information about users, computers, security groups, organizational units, trust relationships, and domain controllers before exporting the results into multiple CSV files and generating an HTML report summarizing the organization's Active Directory inventory.

About 30 minutes later, the attacker expanded reconnaissance by deploying s5cmd, an open-source command-line utility commonly used for high-speed cloud file operations, alongside SharpShares, a well-known C# tool that enumerates accessible Windows network shares. The collected data was ultimately compressed and prepared for exfiltration.

Researchers described the PowerShell script as unusually aggressive, relying on multiple fallback methods to ensure successful domain discovery instead of attempting to remain stealthy.

The findings illustrate a broader trend emerging across the threat landscape. Rather than replacing established attack techniques, AI is allowing attackers with less technical expertise to automate reconnaissance, rapidly generate working tooling, and execute campaigns more efficiently.

"The underlying attack chain still resembles the tried-and-tested smash-and-grab playbook we've seen for years," Huntress researchers wrote. "This core methodology has remained consistent, but it is now being selectively augmented by AI. This hybrid approach prioritises aggression and speed over stealth, allowing threat actors to execute highly damaging campaigns faster than ever."

The Huntress findings align with separate research recently published by Sygnia, which documented an AI-assisted intrusion targeting a large Amazon Web Services environment. Investigators found the attacker moved from initial compromise to widespread cloud control in roughly 72 hours by rapidly chaining together stolen credentials, secrets harvesting, cloud enumeration, CI/CD abuse, persistence mechanisms, and data theft.

Rather than relying on zero-day vulnerabilities or custom malware, the attackers repeatedly leveraged newly acquired credentials to determine permissions, discover additional resources, establish persistence, and continue expanding access throughout the cloud environment. Researchers concluded that AI significantly accelerated decision making while reducing the effort required to coordinate complex attack sequences.

Craig Birch, Principal Technologist at Cayosoft, said organizations should avoid focusing solely on whether malicious code was generated by AI.

"PowerShell-based Active Directory enumeration has been around for years. It is built into Windows, easy to access and often blends in with normal administrative activity. Similar reconnaissance tools have also been publicly available on GitHub for a long time. What's important here is that the attacker already had compromised credentials and RDP access to a domain-joined server before the script ever ran."

Birch added that AI lowers the skill threshold for attackers by making it easier to generate functional reconnaissance tools and organize collected intelligence. As a result, defenders should prioritize eliminating the weaknesses that enabled the intrusion in the first place, including compromised identities, exposed Remote Desktop services, excessive privileges, and identity sprawl.

The research reinforces a growing consensus across the cybersecurity industry that AI is acting as a force multiplier rather than introducing fundamentally new attack techniques. While the tools may be generated faster and adapted more easily, successful intrusions still depend on familiar security gaps such as stolen credentials, weak identity controls, and overly permissive access.

For defenders, the takeaway is increasingly clear: preventing initial access and limiting privilege escalation remain the most effective ways to stop AI-assisted attacks before automation can amplify their impact.