{"schema_version":"0.10.0","id":"LR-2026-0613","record_version":1,"title":"AI-built PowerShell recon script used in an Active Directory enumeration intrusion","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":43.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":3.2,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Security Affairs · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: Security Affairs · subject to change"}]},"sources_hash":"3929cc34470681c60471d3b7387a31b921abfd12827d93fc97802442b509b801"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-07-14","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"automated_monitor","summary":"A threat actor who had gained RDP access with pre-compromised credentials ran a custom PowerShell script, apparently built by prompting an AI model, to map a victim's Active Directory environment on a compromised Windows Server. The script enumerated users, computers, groups, trusts and subnets, saved the results as CSV files and zipped them into an archive. The attacker then deployed the legitimate s5cmd.exe tool and made a second pass with SharpShares.exe to hunt for additional data. Huntress recovered and reconstructed the script from PowerShell logging during an incident response investigation. Because the script was newly written, file signatures would not match, and Huntress's SIEM caught the activity through behavioral telemetry. The report describes the attack as a smash-and-grab playbook selectively augmented by AI rather than a novel technique.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK07","secondary_risks":["RK04","RK03"]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Test: data of others touched with a bounded scope stated. Fact: the victim's Active Directory user, computer, group, OU, subnet, trust and DNS data was dumped to CSV and zipped, on one compromised Windows Server.","harm_class":[],"affected_description":"The victim's Active Directory environment on one compromised Windows Server","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://securityaffairs.com/195321/hacking/attacker-used-ai-to-build-custom-powershell-recon-malware.html","publisher":"Security Affairs","date":"2026-07-14","type":"press","title":"Attacker Used AI to Build Custom PowerShell Recon Malware - Security Affairs","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"event.incident_class":"C","event.detection_method":"C","impact.affected_description":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"The threat actor gained RDP access using pre-compromised credentials, staged tools in C:\\ProgramData, ran the custom recon script within minutes of establishing the session, then roughly thirty minutes later deployed s5cmd.exe, a legitimate Amazon S3 command-line tool that Huntress has seen repeatedly abused for data theft."}],"event.detection_method":[{"source_index":0,"quote":"Huntress’s SIEM caught the activity through behavioral telemetry rather than file signatures."}],"impact.affected_description":[{"source_index":0,"quote":"During an incident response investigation on June 3, 2026, Huntress analyst Jevon Ang recovered a PowerShell script from a compromised Windows Server that the attacker had used to map out the victim’s Active Directory environment."}],"impact.severity":[{"source_index":0,"quote":"Everything landed in a timestamped directory under C:\\AD_Reports_, saved as CSV files."}],"impact.severity_because":[{"source_index":0,"quote":"Everything landed in a timestamped directory under C:\\AD_Reports_, saved as CSV files."}],"event.summary":[{"source_index":0,"quote":"It was custom-built, almost certainly by prompting an AI model until the output worked."},{"source_index":0,"quote":"The threat actor gained RDP access using pre-compromised credentials, staged tools in C:\\ProgramData, ran the custom recon script within minutes of establishing the session, then roughly thirty minutes later deployed s5cmd.exe, a legitimate Amazon S3 command-line tool that Huntress has seen repeatedly abused for data theft."},{"source_index":0,"quote":"Everything landed in a timestamped directory under C:\\AD_Reports_, saved as CSV files."},{"source_index":0,"quote":"After creating the report, the script zipped everything into a single archive."},{"source_index":0,"quote":"A second pass with SharpShares.exe followed, hunting for additional data repositories."},{"source_index":0,"quote":"Huntress’s SIEM caught the activity through behavioral telemetry rather than file signatures."},{"source_index":0,"quote":"The attack itself wasn’t particularly novel."}]},"notes_on_gaps":"Only one press source quoting Huntress was provided. Not stated: the date the incident occurred, the date it was detected, and the date it was disclosed; the June 3, 2026 date is the date of the investigation, so no event dates were entered. Not stated: the AI model name, developer, harness, autonomy level, deployment context, and any record or dollar counts. The sources do not say which control allowed the pre-compromised credentials to be used, so no failed control is listed. The attacker is called a threat actor but its origin is not stated, so adversarial_actor is left out. agent_involved is set to false as a judgement because no autonomous agent is described, only an AI model used to write code. Severity moderate is a judgement from victim data being taken with a scope of one server. Country and industry are not stated. No remediation by the victim is reported; the only remediation entry is advice quoted from Huntress. The Security Affairs article date of 2026-07-14 is not used as a disclosure date because the source does not state it as one. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: Security Affairs · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"caught","text":"Huntress's SIEM caught the activity through behavioral telemetry rather than file signatures.","quote":"Huntress’s SIEM caught the activity through behavioral telemetry rather than file signatures.","source_index":0,"grade":"C"},{"step":"done","text":"Huntress reconstructed the full script from PowerShell script block logging during its investigation.","quote":"Huntress researchers reconstructed the full script from PowerShell script block logging, specifically Event ID 4104 in the Microsoft-Windows-PowerShell/Operational log.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://securityaffairs.com/195321/hacking/attacker-used-ai-to-build-custom-powershell-recon-malware.html"]},"analysis":{"sections":{"timeline":[{"text":"Huntress analyst recovered the recon script during an incident response investigation.","quote":"During an incident response investigation on June 3, 2026, Huntress analyst Jevon Ang recovered a PowerShell script from a compromised Windows Server that the attacker had used to map out the victim’s Active Directory environment.","source_index":0,"when":"2026-06-03"},{"text":"Attacker gained RDP access, staged tools, ran the recon script within minutes, and about thirty minutes later deployed s5cmd.exe.","quote":"The threat actor gained RDP access using pre-compromised credentials, staged tools in C:\\ProgramData, ran the custom recon script within minutes of establishing the session, then roughly thirty minutes later deployed s5cmd.exe, a legitimate Amazon S3 command-line tool that Huntress has seen repeatedly abused for data theft.","source_index":0,"when":null},{"text":"A second pass with SharpShares.exe hunted for additional data repositories.","quote":"A second pass with SharpShares.exe followed, hunting for additional data repositories.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://securityaffairs.com/195321/hacking/attacker-used-ai-to-build-custom-powershell-recon-malware.html"]}}