BREAKING
Attacker Used AI-Made PowerShell Script
How The Intrusion Unfolded
1
RDP via stolen creds
↓
2
Stage tools
↓
3
Run Untitled1.ps1
↓
4
Harvest AD data
↓
5
Zip and exfiltrate
Reconstructed via Event ID 4104
AI Tooling vs Established Tools
AI-generated script
vibe coding
●
Built via LLM prompting
●
Five-stage DC fallback
●
Made a polished HTML report
Established tools
existing
●
BloodHound
●
ADRecon
●
Hand-tuned tradecraft
Noisy, Fast, Not Stealthy
Enable Script-Block Logging
AI NEWS BLITZ
Huntress caught an intruder running a suspected AI-generated script to map Active Directory.