AI is making Active Directory reconnaissance harder to spot by turning it into one-off PowerShell scripts instead of repeatable tools. That means defenders cannot rely on the old pattern of matching BloodHound, PowerSploit, or other known offensive fingerprints to catch this activity.
Huntress recovered a June 3 PowerShell script used in an incident and found it was AI-generated, built to enumerate an AD environment in a custom way. The report says this pattern creates many unique indicators and pushes detection away from tool signatures toward broader behavior hunting across PowerShell and AD activity.