AI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress

Key Points:

• A new trend in malware development, termed "vibe coding," allows threat actors to generate bespoke scripts using AI, significantly lowering the barrier for entry into cybercrime.
• The incident involved a PowerShell script (Untitled1.ps1) used for Active Directory enumeration, executed via RDP on a compromised Windows Server, enabling data exfiltration and further reconnaissance.
• Security teams should focus on behavioral analytics rather than traditional signature-based detection methods to identify and mitigate these unique AI-generated threats.

Technical Details: The attack utilized a PowerShell script generated through iterative AI prompts, showcasing distinct hallmarks of AI generation. This includes an over-engineered method for domain controller identification and systematic data collection from Active Directory.

MITRE ATT&CK Techniques:

• T1078 - Valid Accounts (Initial Access)
• T1047 - Windows Management Instrumentation (Execution)
• T1003.001 - OS Credential Dumping: LSASS Memory (Credential Access)
• T1059.001 - Command and Scripting Interpreter: PowerShell (Execution)

IOCs Mentioned:

• C:\ProgramData\Untitled1.ps1
• C:\ProgramData\s5cmd.exe
• C:\ProgramData\SharpShares.exe