Analyzing Vibe-Coded AD Enumeration

Threat actors are now using AI (vibe coding) to generate bespoke PowerShell scripts for Active Directory reconnaissance, bypassing traditional signature-based detection. Huntress analysts recovered and dissected a real AI-generated AD enumeration script (Untitled1.ps1) used in a June 2026 incident. The script exhibits clear LLM hallmarks: a 'FULLY FIXED' title from iterative prompting, an unedited placeholder server name, over-engineered five-method DC discovery, repetitive try/catch blocks, and excessive colorful console output. The script systematically dumps AD users, computers, groups, OUs, subnets, and trusts into CSVs, generates an HTML summary report, and zips everything for exfiltration. The key detection implication: since vibe-coded scripts are unique per generation, hash and static signature detection fails. Defenders must pivot to behavioral analytics targeting the underlying AD interaction patterns that AI cannot obscure.

Nguồn: https://www.huntress.com/blog/ai-coded-malware-vibe-coding-active-directory. 8sync News chỉ tóm tắt và dẫn link; bản quyền nội dung thuộc tác giả và nguồn gốc.

Đề xuất cho bạn

Huntress Blog0 Hot7 phút3 giờ trước

LoTL Abuse: How to Spot It vs. Normal Admin Activity

Living-off-the-land (LoTL) attacks abuse legitimate tools like PowerShell, WMI, and RMM software to blend in with normal IT activity. Five key warning signs distinguish malicious use from routine admin work: the tool appearing in unexpected hands, activity originating from unusual machines, abnormal process chains, subtly off command-line syntax, and follow-on behaviors like reconnaissance or lateral movement. Defenders should pressure-test suspicious activity by examining who used the tool, where it ran, how it launched, and what happened next. Preventive measures include better process chain visibility, stronger admin activity logging, tighter control over high-risk tools, and eliminating dormant accounts and legacy systems.

#powershellNguồn