Execution of AI-generated Untitled1.ps1 AD enumeration script

Duo Tech@duotech

•updated Jul 15, 2026•2•0•6

Detects the execution of known Active Directory enumeration scripts or commands via PowerShell shortly after a Remote Desktop (RDP) login session is established on a device. This pattern is indicative of an attacker who has gained remote access and is immediately performing discovery activities.