Cross-source coverage
T1482 / ATT&CK
Domain Trust Discovery
From MITRE ATT&CK 19.2
Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain. Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct SID-History Injection, Pass the Ticket, and Kerberoasting. Domain trusts can be enumerated using the DSEnumerateDomainTrusts() Win32 API call,.NET methods, and LDAP. The Windows utility Nltest is known to be used by adversaries to enumerate domain trusts.
- Tactics
- Discovery
- Platforms
- Windows
- Telemetry
-
WinEventLog:SysmonWinEventLog:PowerShellWinEventLog:Security
How MITRE says to detect it DET0007
Detection of Domain Trust Discovery via API, Script, and CLI Enumeration
Windows Analytic 0016
Adversary uses nltest, PowerShell, or Win32/.NET API to enumerate domain trust relationships (via DSEnumerateDomainTrusts, GetAllTrustRelationships, or LDAP queries), followed by discovery or authentication staging.
WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=7WinEventLog:SysmonEventCode=10WinEventLog:PowerShellGet-ADTrust|GetAllTrustRelationshipsWinEventLog:SecurityEventCode=4662
SigmaHQ/sigma
17 rules| Detection | Severity | Format |
|---|---|---|
| BloodHound Collection Files | High | Sigma |
| HackTool - Bloodhound/Sharphound Execution | High | Sigma |
| HackTool - SharpView Execution | High | Sigma |
| HackTool - TruffleSnout Execution | High | Sigma |
| Malicious PowerShell Commandlets - PoshModule | High | Sigma |
| Malicious PowerShell Commandlets - ProcessCreation | High | Sigma |
| Malicious PowerShell Commandlets - ScriptBlock | High | Sigma |
| PUA - AdFind Suspicious Execution | High | Sigma |
| Renamed AdFind Execution | High | Sigma |
| Suspicious Active Directory Database Snapshot Via ADExplorer | High | Sigma |
+ 7 more from SigmaHQ/sigma → showing the 10 highest-severity
socfortress/Wazuh-Rules
14 rules · 12 families| Detection | Severity | Format |
|---|---|---|
| Sysmon - Event 1: Process creation · AdFind OU enumeration (T1482) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · AdFind trust enumeration (T1482) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · dsquery domain trust discovery (T1482) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · nltest domain_trusts (T1482) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · nltest trusted_domains (T1482) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · PowerShell DirectoryServices Trusts (T1482) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · PowerShell Get-ForestTrust (T1482) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · PowerShell Get-NetDomainTrust (T1482) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · TruffleSnout domain enumeration (T1482) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · TruffleSnout forest enumeration (T1482) | High | Wazuh XML |
+ 4 more from socfortress/Wazuh-Rules → showing the 10 highest-severity
splunk/security_content
14 rules| Detection | Severity | Format |
|---|---|---|
| Detect AzureHound Command-Line Arguments | Undefined | SPL |
| Detect AzureHound File Modifications | Undefined | SPL |
| Detect SharpHound Command-Line Arguments | Undefined | SPL |
| Detect SharpHound File Modifications | Undefined | SPL |
| Detect SharpHound Usage | Undefined | SPL |
| DSQuery Domain Discovery | Undefined | SPL |
| Get-DomainTrust with PowerShell | Undefined | SPL |
| Get-DomainTrust with PowerShell Script Block | Undefined | SPL |
| Get-ForestTrust with PowerShell | Undefined | SPL |
| Get-ForestTrust with PowerShell Script Block | Undefined | SPL |
+ 4 more from splunk/security_content → showing the 10 highest-severity
elastic/detection-rules
8 rules| Detection | Severity | Format |
|---|---|---|
| Potential PowerShell HackTool Script by Function Names | Medium | Elastic TOML |
| Suspicious JetBrains TeamCity Child Process | Medium | Elastic TOML |
| Active Directory Discovery using AdExplorer | Low | Elastic TOML |
| AdFind Command Activity | Low | Elastic TOML |
| Enumerating Domain Trusts via DSQUERY.EXE | Low | Elastic TOML |
| Enumerating Domain Trusts via NLTEST.EXE | Low | Elastic TOML |
| PowerShell Suspicious Discovery Related Windows API Functions | Low | Elastic TOML |
| Suspicious Access to LDAP Attributes | Low | Elastic TOML |
elastic/protections-artifacts
8 rules| Detection | Severity | Format |
|---|---|---|
| Active Directory Data Collection via LDAP | Undefined | Elastic TOML |
| AD Certificate Services Enumeration via LDAP | Undefined | Elastic TOML |
| Domain Accounts Enumeration via LDAP Search | Undefined | Elastic TOML |
| Domain Trust and Schema Enumeration via LDAP | Undefined | Elastic TOML |
| Group and Privileged Accounts Discovery via LDAP | Undefined | Elastic TOML |
| Sensitive Attributes Discovery via LDAP | Undefined | Elastic TOML |
| Suspicious Enumeration via LDAP Search | Undefined | Elastic TOML |
| Suspicious Kerberos Enumeration via LDAP Search | Undefined | Elastic TOML |
Bert-JanP/Hunting-Queries-Detection-Rules
3 rules · 2 families| Detection | Severity | Format |
|---|---|---|
| MITRE ATT&CK Mapping | Undefined | KQL |
| Nltest Discovery Activities 2 variants | Undefined | KQL |
| Nltest Discovery Activities 2 variants | Undefined | KQL |
Azure/Azure-Sentinel
1 rule| Detection | Severity | Format |
|---|---|---|
| Suspicious enumeration using Adfind tool (Normalized Process Events) | Undefined | KQL |