Full Report
Threat actors are now using AI to generate custom PowerShell scripts for Active Directory attacks. Our team analyzed real vibe-coded malware and what it means for defenders.
Analysis Summary
# Tool/Technique: Vibe-Coded PowerShell Recon Script
## Overview
This is a bespoke, AI-generated (vibe-coded) PowerShell script designed for rapid Active Directory (AD) enumeration and reconnaissance. The term "vibe coding" refers to the process where a threat actor uses natural language prompts to iteratively generate functional code via AI, rather than writing the syntax manually. Its primary purpose is to map the target domain's architecture, users, and assets immediately following initial access.
## Technical Details
- **Type:** Technique / Bespoke Malware (AI-Generated)
- **Platform:** Windows (Active Directory environments)
- **Capabilities:** AD enumeration, automated reporting, file-based data staging.
- **First Seen:** June 3, 2024 (Incident Date)
## MITRE ATT&CK Mapping
- **TA0007 - Discovery**
- T1087.002 - Account Discovery: Domain Account
- T1018 - Remote System Discovery
- T1482 - Domain Trust Discovery
- **TA0009 - Collection**
- T1119 - Automated Collection
- **TA0010 - Exfiltration**
- T1567 - Exfiltration Over Web Service (Related to secondary tools like s5cmd)
## Functionality
### Core Capabilities
- **AD Mapping:** Automatically identifies the Domain Controller (DC) and maps users, computers, and domain structures.
- **Data Staging:** Creates local directories to export gathered information into multiple flat files.
- **Reporting:** Generates a summary file named `AD_Report.html` to allow the attacker to quickly verify the success and scope of the enumeration.
### Advanced Features
- **AI-Augmented Iteration:** The script features highly descriptive, non-standard titles (e.g., "100% Working AD Information Gathering Script - FULLY FIXED"), suggesting it was refined through multiple AI prompts to overcome execution errors.
- **High-Speed Execution:** Designed to run immediately upon RDP entry to minimize the time between breach and data acquisition.
## Indicators of Compromise
- **File Names:** `Untitled1.ps1`, `AD_Report.html`
- **Network Indicators:** Connection to Amazon S3 buckets (associated with the use of `s5cmd.exe` for exfiltration - *Note: specific bucket URLs were not provided in the source*).
- **Behavioral Indicators:**
- Rapid execution of PowerShell scripts from `C:\ProgramData\`.
- Excessive calls to Active Directory via PowerShell (Event ID 4104).
- Creation of HTML reports in staging directories following AD discovery commands.
## Associated Threat Actors
- Unknown (The technique is described as a "hybrid approach" used by attackers prioritizing speed over stealth).
## Detection Methods
- **Behavioral Detection:** Monitor for "Script Block Logging" (Windows Event ID 4104). Even if the script is bespoke, the underlying PowerShell commands for AD enumeration remain detectable.
- **Process Monitoring:** Alert on the use of `C:\ProgramData\` for staging executable scripts and tools.
- **Heuristic Detection:** Look for legitimate tools being used in unusual contexts, such as `s5cmd.exe` or `SharpShares.exe` appearing on servers without administrative justification.
## Mitigation Strategies
- **Hardening Recommendations:** Restrict RDP access to known internal IP addresses or require MFA/VPN (though the attacker in this case bypassed VPN with compromised credentials).
- **Least Privilege:** Implement the principle of least privilege to ensure that compromised user accounts have limited visibility into the broader AD structure.
- **PowerShell Security:** Enforce Constrained Language Mode and require signed scripts where possible.
## Related Tools/Techniques
- **s5cmd:** A high-speed S3 utility used for data exfiltration.
- **SharpShares.exe:** A tool used to hunt for accessible network shares.
- **BloodHound / PowerSploit:** Traditional (non-AI) tools that perform similar AD enumeration functions.