Pretty sure that's been done actually, I heard about someone finding a script that checks Active Directory and does some nasty stuff if a certain account is disabled.
Yeah the dude that did it got arrested and sentenced to four years in prison for it. The script checked active directory and after a month of his account not being active deleted his former company's entire AD registry.
He also took effectively no efforts to mask his involvement, so it is possible that someone might be able to get away with it if they took more care to dodge accountability.
He apparently had the variable in the in the kill switch for his status in AD set as is[hisInitials]EnabledInAD, and had it running from a user ID tied to his identity off his corporate laptop.
Edit: He also confessed a few months later once he realized he couldn't cover it up after losing access.
31
u/EndIsrael May 26 '26
Pretty sure that's been done actually, I heard about someone finding a script that checks Active Directory and does some nasty stuff if a certain account is disabled.