Threat actors are no longer just writing malware faster with AI, they are shipping code with the artifacts of an AI chat session still visible inside it, a tell that is becoming its own detection signal.
Incident responders at Huntress, investigating a June 3 intrusion, recovered a PowerShell script an attacker used to map an Active Directory environment after gaining RDP access to a domain-joined Windows Server. The script’s own internal title, “100% Working AD Information Gathering Script, FULLY FIXED,” reads like the output of an iterative back-and-forth with a chatbot rather than something a human operator wrote from scratch, according to Huntress’s research. The tool enumerated domain controllers, users, computers, groups, organizational units, trusts, and subnets, wrote nine CSV and text files plus an HTML summary report into C:\AD_Reports, then zipped the results for exfiltration.
Why it matters to the security leader: the techniques inside the script, domain controller discovery, AD enumeration, staged local export, are not new. What changed is who can now produce a working version of them in minutes. Huntress flagged giveaways beyond the title: five cascading methods for locating the domain controller, including a hardcoded fallback with an unedited example server name left in, plus console output color-coded for readability an attacker never needs. That mix of exhaustiveness and unnecessary polish is a pattern large language models produce and human operators generally skip.
The original insight is a detection one: Huntress argues behavioral monitoring holds up better against AI-generated tooling than signature or hash-based detection, since an LLM can rewrite a script’s syntax endlessly while the underlying mechanics, querying a domain controller, enumerating trusts, exporting to a staging directory, stay constant. CyberTech has covered the broader shift this fits into in our coverage of shadow AI and prompt injection as leading 2026 attack categories. SOC teams should weight detection toward the behavior of AD enumeration itself, unusual LDAP queries and bulk object exports, rather than betting on catching the next AI-generated script by its file hash.
Source: Huntress
