Suspicious Entry AD Module notes.md

Reddit Post.md

Posted reddit thread: https://www.reddit.com/r/PowerShell/comments/1von1d7/comment/p41z4et Date: 2026-08-15

The version currently up didn't appear to execute something malicious currently -- but it looks more suspicious than not.

The domain is not github, and the cert was invalid. Unlike the guy below, who said he got 404

• hashed HOMEPATH and ComputerName
• which version of the module you ran
• Your powershell version
• OS version
• system culture

It's possible it's scouting targets. Or it could be an AI that published a package by accident.

It sends a POST request to https://api.eu.amplitude.com/2/httpapi

• Here's the link to v0.3 https://www.powershellgallery.com/packages/Entra/0.3/Content/Entra-check.ps1

There's other suspicious parts. Mainly it says:

module contains no functional code and does not need to be installed or used.

But executing another script Entra-Check https://www.powershellgallery.com/packages/Entra/0.3/Content/Entra.psd1

• the module executes a script (that isn't the module psm1)
• commented code executed another script (to install VC++ runtime )
• commented code accidentally to import Microsoft.AzureAD.Kdc.Management.dll

 

# RootModule = 'Microsoft.AzureAD.Kdc.Management.dll'
# Script files (.ps1) that are run in the caller's environment prior to importing this module.
# ScriptsToProcess = 'check-and-install-vc-runtime.ps1'
ScriptsToProcess = 'Entra-Check.ps1'

The author site: https://alweys.ch/ Is serving a cert for a different domain: *.msha-slice-5-am2-0-ase.p.azurewebsites.net

TL:DR Is it suspect? Maybe just AI assisted?

The invalid cert could be misconfigured publish?

The code issues could be from someone using an LLM to copy this module: https://www.powershellgallery.com/packages/AzureADHybridAuthenticationManagement/2.4.71.0/Content/AzureADHybridAuthenticationManagement.psd1

That could explain why they call Write-Telemetry in both the psm1 and second ps1

And why it references the VC++ runtime installer https://www.powershellgallery.com/packages/AzureADHybridAuthenticationManagement/2.4.71.0/Content/check-and-install-vc-runtime.ps1

And funny comments like

# Define the URL
$url = "https://api.eu.amplitude.com/2/httpapi"

Suspicious Entry AD Module notes.md

date: 2026-08-14

The description for this repo says it's to prevent squatting, But it's sending a POST request to a remote server with powershell version, and OS version numbers, machine names / user names / folder paths etc.

It claims:

quote: https://www.powershellgallery.com/packages/Entra/0.3/Content/Entra.psd1 module intended to prevent typo-squatting of the Microsoft.Entra, Microsoft.Entra.Beta, Microsoft.Graph.Entra and Microsoft.Graph.Entra.Beta" It contains no functional code and does not need to be installed or used.

Some of the references could be explained as mistakes copying from this module, maybe using an LLM:

• https://www.powershellgallery.com/packages/AzureADHybridAuthenticationManagement/2.4.71.0/Content/AzureADHybridAuthenticationManagement.psd1

But then why is it explicitly executing code and exfiltrating software versions and users and when it says it does nothing?

---

author site: https://alweys.ch/

Is using a cert for a totally different domain cert was: cert was

net::ERR_CERT_COMMON_NAME_INVALID

curl.exe --output 'curl-domain-alweys.ch.html' --show-headers --verbose https://alweys.ch/
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* Host alweys.ch:443 was resolved.
* IPv6: (none)
* IPv4: 51.124.91.155
*   Trying 51.124.91.155:443...
* schannel: disabled automatic use of client certificate
* ALPN: curl offers http/1.1
* schannel: SNI or certificate check failed: SEC_E_WRONG_PRINCIPAL (0x80090322) - The target principal name is incorrect.
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
* closing connection #0
curl: (60) schannel: SNI or certificate check failed: SEC_E_WRONG_PRINCIPAL (0x80090322) - The target principal name is incorrect.
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.

---

Here's the attached request and response

Request and Response

VERBOSE: WebRequest: v1.1 POST https://api.eu.amplitude.com/2/httpapi with application/x-www-form-urlencoded payload with body size 453 B (453 bytes)
DEBUG: WebRequest Detail
--- HEADERS
User-Agent: Mozilla/5.0 (Windows NT 10.0; Microsoft Windows 10.0.19045; en-US) PowerShell/7.6.3

Content-Type: application/x-www-form-urlencoded
Content-Length: 453

--- BODY
{
  "events": {
    "os_name": "Microsoft Windows x",
    "user_id": "7457ae0afd65cda4287e63e11fb65466e8b23cd71088e8a6b0c7ce2b0e772932",
    "device_id": "efb5a5ad7522096cd339dd8290cd39d346b8afcd0bee8b3f73d086e791dc907d",
    "device_brand": "unknown-0.3",
    "platform": "PowerShell 5.1.0",
    "language": "ar-Sa",
    "event_type": "EntraScriptsToProcess",
    "ip": "$remote"
  },
  "api_key": "c0cd5aa997bde6dd291d06729c7548a7"
}
VERBOSE: WebResponse: 200 OK with application/json payload with body size 92 B (92 bytes)
DEBUG: WebResponse Detail
--- HEADERS
Date: Sat, 15 Aug 2026 03:33:41 GMT
Connection: keep-alive
Access-Control-Allow-Origin: *
Strict-Transport-Security: max-age=15768000

Content-Type: application/json
Content-Length: 92

--- BODY
{"code":200,"server_upload_time":1786764821923,"payload_size_bytes":453,"events_ingested":1}

ZExtra Notes.md

About

Some of this file is new, the rest is duplicate text moved

I think it has a bug where it meant to include the IP but had a string interpolation error, so it sent the literal string '$remote' instead of the actual IP address.

The linked site owner is not github, and it responds with a broken / invalid web cert

On load this module executes a script to send information to this url:

• https://api.eu.amplitude.com/2/httpapi

This doesn't appear to execute malware currently, as of v0.3 But it's suspect in a few ways:

It says it "contains no functional code" but comments mention installing and running code, but

• it executes a the script Entra-Check.ps1 ( to sends user info )
• has a commented line to execute a script check-and-install-vs-runtime.ps1
• commented line importing VcRedist
• commented out swapping Microsoft.AzureAD.Kdc.Management.dll' in place of Entry.psm1

If they change one of those lines and update, could this module be used to indirectly load or execute a modified Microsoft.AzureAD.Kdc.Management.dll' when the module is imported? ( Note it has an extra explicit $module = Get-Module -Name Entra -ListAvailable )

# Modules that must be imported into the global environment prior to importing this module
#RequiredModules = @(@{ModuleName = 'VcRedist'; GUID = '9139778c-9a1a-4faf-aa88-5ac6fd3b3e48'; ModuleVersion = '3.0.256'; })

# Script files (.ps1) that are run in the caller's environment prior to importing this module.
#ScriptsToProcess = 'check-and-install-vc-runtime.ps1'
ScriptsToProcess = 'Entra-Check.ps1'

but it's sending the user's information to the server. accidentally included? comments say:

• "(.ps1) are run in the callers env prior to import" and
• and (accidentally included) comments run in caller's env" and "install vc runtime"

Script files (.ps1) that are run in the caller's environment prior to importing this module.

#ScriptsToProcess = 'check-and-install-vc-runtime.ps1'

It contains:

• hashed HOMEPATH and ComputerName
• event name, module version/name
• PowerShell version
• Operating system name / version
• local culture/language
• a hardcoded API key
• a bug, it meant to send '$remote' but failed at string interpolation. Unless it's meant to be a literal $remote

this is version 0.3: https://www.powershellgallery.com/packages/Entra/0.3 or https://www.powershellgallery.com/packages/Entra/0.3/Content/Entra-check.ps1

It responds with a HTTP 200 OK of

{"code":200,"server_upload_time":1786764821923,"payload_size_bytes":453,"events_ingested":1}

It has strange comments, especially for files that are so short.

# Convert the data to JSON format
$jsonBody = $jsonData | ConvertTo-Json
# Define the URL
$url = "https://api.eu.amplitude.com/2/httpapi"

snip 2

It has weird comments and bugs, probably AI assisted? It's only a few lines in total though.

# Convert the data to JSON format
$jsonBody = $jsonData | ConvertTo-Json
# Define the URL
$url = "https://api.eu.amplitude.com/2/httpapi"

I thought this was a bug unless it wants a literal '$remote' ?

$jsonData = @{
    "ip" = '$remote'
}