Skip to content

Back to the catalog

AI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
huntress.comwriteup

AI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress

Huntress recovered and reconstructed "Untitled1.ps1," a PowerShell Active Directory enumeration script used by an attacker during a June 3 incident via RDP access with compromised credentials, and identified it as AI-generated ("vibe-coded") based on artifacts like an unedited LLM placeholder hostname, a "FULLY FIXED" prompt-iteration title, over-engineered five-method DC-discovery fallback logic, and gratuitous colored console/HTML reporting output. The attack chain paired this bespoke recon tool with off-the-shelf abuse of s5cmd (legitimate AWS S3 CLI used for exfiltration) and SharpShares (share enumeration), illustrating how LLM-generated one-off malware evades hash/signature-based detection and pushes defenders toward behavioral analytics on Active Directory enumeration patterns.

TL;DR Huntress reverse-engineers a real-world AI-generated PowerShell AD enumeration script, showing telltale LLM artifacts (placeholder hostnames, over-engineered fallbacks) and arguing detection must shift from signatures to behavior.
Open original ↗
Document

What it is

A Huntress incident-response writeup of Untitled1.ps1, a bespoke AI-generated ("vibe-coded") PowerShell Active Directory enumeration script recovered from an intrusion on June 3. The summary covers the attack chain and the LLM tells; what it omits are the concrete on-disk artifacts and the telemetry source that let Huntress reconstruct the script — the details a defender needs to hunt for this.

How it works

The script runs a five-step cascading fallback to find the domain and primary DC — DNS, then nltest, then the AD module, then environment variables, then a hardcoded fallback that still contains an LLM placeholder server name (the "smoking gun"). It then dumps AD Users, Computers, Groups, OUs, Subnets, and Trusts via repetitive try/catch blocks into a timestamped staging folder, generates an HTML success report, and zips everything for exfiltration.

Preconditions / Affected

A domain-joined Windows Server the attacker can reach interactively. In this case: VPN-then-RDP access with pre-compromised credentials, operating from interactive command prompts. No exploit — this is post-access enumeration.

What to do

Hunt for these specific artifacts. The script's output is noisy and named predictably:

  • Staging directory: C:\AD_Reports_<datetime>\ and the archive C:\AD_Reports_<datetime>.zip
  • Files created: AD_Users.csv, AD_Computers.csv, AD_Groups.csv, AD_OUs.csv, AD_Subnets.csv, AD_Trusts.csv, AD_Users_With_Email.csv, AD_Simple_Users.csv, DNS_Subnets.txt, AD_Report.html
  • Tooling in staging: C:\ProgramData\Untitled1.ps1, C:\ProgramData\s5cmd.exe (legitimate high-speed S3 tool, abused for exfil), SharpShares.exe (share enumeration, run with common admin shares filtered out)
  • Telemetry: Huntress reconstructed the full script from Event ID 4104 in the Microsoft-Windows-PowerShell/Operational log (script-block logging). Ensure this is enabled and retained — it captured deployed script blocks in full.

Timeline is tight: recon ran within minutes of RDP session start; s5cmd exfiltration followed ~30 minutes later.

Caveats

This is a single incident, not a campaign signature — filenames and the placeholder server name are specific to one prompt session and will vary between actors. The article's central point is behavioral: signature-based detection of off-the-shelf tools (BloodHound, PowerSploit, Cobalt Strike) won't catch bespoke single-use scripts, so lean on the aggressive/noisy AD-dump behavior and script-block logging rather than static IOCs.

Technologies named here

Techniques named here

  • Tool staging in C:\ProgramData\
  • AI-generated Active Directory enumeration
  • Data exfiltration via S3 upload tooling
  • Share enumeration
  • Behavioral/telemetry-based detection

Threat actors named here

Also named here

  • SharpShares

Related in Threat Intel