PowerShell execution of Untitled1.ps1 AD enumeration script from ProgramData

Duo Tech@duotech

•updated Jul 15, 2026•3•0•14

Detects the execution of PowerShell scripts associated with unauthorized Active Directory information gathering. This includes the execution of specific scripts from ProgramData and the logging of known reconnaissance commands or script contents within PowerShell event logs.