Attacker Uses Suspected AI-Generated PowerShell Script to Map Active Directory

An unknown threat actor employed an AI-generated PowerShell script to comprehensively map an Active Directory environment, identifying Domain Controllers, users, computers, and domains. The attacker leveraged pre-compromised RDP credentials on a Windows Server, staged tools in system folders, and generated a detailed AD_Report.html capturing enumeration results. Analysis points to AI coding through prompt-iteration artifacts and script structure characteristics. The incident demonstrates that threat actors use AI models not for entirely novel attack vectors, but to automate and professionalize well-known post-compromise techniques, significantly lowering accessibility of highly capable tools to cybercriminals.