tool

Nltest S0359

Type: tool
Platform: Windows
Created: 14 February 2019
Last modified: 12 May 2026

Nltest is a Windows command-line utility used to list domain controllers and enumerate domain trusts.[1]

TechniquesBottom 12%

TacticBottom 6%

Threat groupsunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0359

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.	Generic	test	ps_script	windows	PowerShell	Discovery Account Discovery Domain Account Discovery Remote System Discovery	-	low	frack113	2022-03-17	2023-07-08	36bed6b2-e9a0-4fff-beeb-413a92b86138
	Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-03-14	2025-07-09	9212f354-7775-4e28-9c9f-8f0a4544e664
	Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. (...)	Generic	experimental	file_event	windows	Sysmon	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	medium	Arnim Rupp (Nextron Systems), Thomas Patzke	2025-07-09	—	0a1255c5-d732-4b62-ac02-b5152d34fb83
	Detects default file names outputted by the BloodHound collection tool SharpHound	Generic	test	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	C.J. May	2022-08-09	2026-02-19	02773bed-83bf-469f-b7ff-e676e7d78bab
	Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery Remote System Discovery Persistence Server Software Component Web Shell Discovery System Owner/User Discovery	CVE-2022-41040 CVE-2022-41082	high	Florian Roth (Nextron Systems), MSTI (query)	2022-10-01	—	fa3c117a-bc0d-416e-a31b-0c0e80653efb
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Reconnaissance Gather Victim Network Information Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	71ac5328-2364-40cf-8381-92b8dc531399
Splunk	This analytic detects bursts of ping, SSH, and Telnet commands issued from Cisco IOS or NX-OS devices. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Discovery Network Service Discovery Lateral Movement Remote Services SSH Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	efb20922-17bc-4fb0-880c-be50cfc100dd
Splunk	This analytic identifies non-browser processes reaching out to public IP lookup or geolocation servi (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Reconnaissance Gather Victim Network Information IP Addresses Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali, Splunk, Janantha Marasinghe	2025-07-01	2026-09-22	568cb83e-d79e-4a23-85ec-6e1f6c30cb2f
Splunk	The following analytic detects a blocked connection event by identifying a "Block" value in the action field. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	17e9b764-3a2b-4d36-9751-32d13ce4718b
Splunk	The following analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	1f57f10e-1dc5-47ea-852c-2e85b2503d79
Splunk	The following analytic detects the execution of the `Invoke-AzureHound` command-line argument, commonly used by the AzureHound tool. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-05-13	26f02e96-c300-11eb-b611-acde48001122
Splunk	The following analytic detects the creation of specific AzureHound-related files, such as `*-azurecollection.zip` and various `.json` files, on disk. (...)	Generic	stable	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-05-13	1c34549e-c31b-11eb-996b-acde48001122
Splunk	The following analytic detects the execution of SharpHound command-line arguments, specifically `-collectionMethod` and `invoke-bloodhound`. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	a0bdd2f6-c2ff-11eb-b918-acde48001122
Splunk	The following analytic detects the creation of files typically associated with SharpHound, a reconnaissance tool used for gathering domain and trust data. (...)	Generic	stable	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	42b4b438-beed-11eb-ba1d-acde48001122
Splunk	The following analytic detects the usage of the SharpHound binary by identifying its original filename, `SharpHound.exe`, and the process name. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	dd04b29a-beed-11eb-87bc-acde48001122
	Enumerates Active Directory to determine computers that are joined to the domain	Generic	test	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	frack113	2022-02-12	—	1f6399cf-2c80-4924-ace1-6fcff3393480
	Detects DNS server discovery via LDAP query requests from uncommon applications	Generic	test	dns	windows	Sysmon	Discovery Domain Trust Discovery	-	low	frack113	2022-08-20	2023-09-18	a21bcd7e-38ec-49ad-b69a-9ea17e69509e
Splunk	The following analytic detects the execution of `nltest.exe` with command-line arguments `/dclist:` or `/dsgetdc:` to discover domain controllers. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-07-20	41243735-89a7-4c83-bcdd-570aa78f00a1
Splunk	The following analytic identifies the execution of `wmic.exe` with command-line arguments used to discover domain controllers in a Windows domain. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	64c7adaa-48ee-483c-b0d6-7175bc65e6cc
	Detects execution of "dsquery.exe" for domain trust discovery	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery	-	medium	E.M. Anhaus, Tony Lambert, oscd.community, omkar72	2019-10-24	2023-02-02	3bad990e-4848-4a78-9530-b427d854aac0
Splunk	The following analytic detects the execution of "dsquery.exe" with arguments targeting `TrustedDomain` queries directly from the command line. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Domain Trust Discovery	-	medium	Michael Haag, Splunk	2021-03-31	2026-10-02	cc316032-924a-11eb-91a2-acde48001122
	Adversaries may look for details about the network configuration and settings of systems they access (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Network Configuration Discovery	-	low	frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'	2021-12-07	2025-10-18	0e4164da-94bc-450d-a7be-a4b176179f1f
Splunk	The following analytic identifies the execution of the Get-DomainTrust command from PowerView using PowerShell, which is used to gather domain trust information. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Domain Trust Discovery	-	medium	Michael Haag, Splunk	2021-09-02	2026-10-02	4fa7f846-054a-11ec-a836-acde48001122
Splunk	The following analytic detects the execution of the Get-DomainTrust command from PowerView using PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Domain Trust Discovery	-	medium	Michael Haag, Splunk	2021-09-02	2026-05-13	89275e7e-0548-11ec-bf75-acde48001122
Splunk	The following analytic detects the execution of the Get-ForestTrust command via PowerShell, commonly used by adversaries to gather domain trust information. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Domain Trust Discovery	-	medium	Michael Haag, Splunk	2021-09-02	2026-10-02	584f4884-0bf1-11ec-a5ec-acde48001122
Splunk	The following analytic detects the execution of the Get-ForestTrust command from PowerSploit using PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery	-	medium	Michael Haag, Splunk	2021-09-02	2026-05-13	70fac80e-0bf1-11ec-9ba0-acde48001122
Splunk	The following analytic detects the execution of `powershell.exe` with the `Get-AdComputer` commandlet, which is used to discover remote systems within a domain. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	c5a31f80-5888-4d81-9f78-1cc65026316e
Splunk	The following analytic detects the execution of the `Get-AdComputer` PowerShell commandlet using PowerShell Script Block Logging (EventCode=4104). (...)	Hunting	stable	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-10-02	a9a1da02-8e27-4bf7-a348-f4389c9da487
Splunk	The following analytic detects the execution of `powershell.exe` with command-line arguments that utilize `Get-DomainComputer` to discover remote systems. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	ed550c19-712e-43f6-bd19-6f58f61b3a5e
Splunk	The following analytic detects the execution of the `Get-DomainComputer` commandlet using PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	f64da023-b988-4775-8d57-38e512beb56e
Splunk	The following analytic detects the execution of `powershell.exe` with the `Get-DomainController` command, which is used to discover remote systems within a Windows domain. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-10-02	868ee0e4-52ab-484a-833a-6d85b7c028d0
Splunk	The following analytic detects the execution of the `Get-DomainController` commandlet using PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	676b600a-a94d-4951-b346-11329431e6c1
Splunk	The following analytic detects the execution of `powershell.exe` with command-line arguments that utilize the `Get-WmiObject` cmdlet to discover remote systems, specifically targeting the `DS_Computer` parameter. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-10-02	7141122c-3bc2-4aaa-ab3b-7a85a0bbefc3
Splunk	The following analytic detects the execution of the `Get-WmiObject` cmdlet with the `DS_Computer` class parameter via PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	29b99201-723c-4118-847a-db2b3d3fb8ea
	Detects command line parameters used by Bloodhound and Sharphound hack tools	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	Florian Roth (Nextron Systems)	2019-12-20	2023-02-04	f376c8a7-a2d0-4ddc-aa0c-16c17236d962
	Detects execution of the hacktool NetExec. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Lateral Movement Remote Services Discovery Remote System Discovery	-	high	Chirag Damani	2026-03-29	—	7638e5fe-600c-4289-a968-f49dd537ec7d
	Adversaries may look for details about the network configuration and settings of systems they access (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery Discovery Network Share Discovery Discovery Permission Groups Discovery Domain Groups Discovery System Network Connections Discovery Discovery System Owner/User Discovery	-	high	frack113	2021-12-10	2023-02-14	b2317cfa-4a47-4ead-b3ff-297438c0bc2d
	Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery	-	high	frack113	2022-08-20	2023-02-13	69ca006d-b9a9-47f5-80ff-ecd4d25d481a
Splunk	The following analytic detects suspicious system network configuration discovery activities, which may indicate an adversary's attempt to gather information about the network environment. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Discovery System Network Configuration Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-10-02	5db16825-81bd-4923-a8d6-d6a13a59832a
	Detects the enumeration of other remote systems.	Generic	test	process_creation	linux	Sysmon	Discovery Remote System Discovery	-	low	Alejandro Ortuno, oscd.community	2020-10-22	2021-11-27	11063ec2-de63-4153-935e-b1a8b9e616f1
Splunk	The following analytic identifies potential enumeration of local network configuration on Linux systems. (...)	Anomaly	stable	process_creation	linux	Sysmon · Osquery	Discovery System Network Configuration Discovery	-	medium	Teoderick Contreras, Splunk	2022-02-14	2026-10-02	535cb214-8b47-11ec-a2c7-acde48001122
	Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.	Hunting	test	ps_module	windows	PowerShell	Discovery Software Discovery Security Software Discovery Discovery System Network Configuration Discovery	-	low	Christopher Peacock @SecurePeacock, SCYTHE @scythe_io	2023-07-13	—	ea207a23-b441-4a17-9f76-ad5be47d51d3
Splunk	This analytic detects attempts to enumerate or verify the configuration of the macOS application firewall. (...)	Anomaly	stable	process_creation	-	Osquery	Discovery System Network Configuration Discovery	-	medium	Jamie Windley, Splunk	2026-04-15	2026-10-02	f8db6e0b-55bb-40ca-bc85-2b3700adb0f8
	Detects the enumeration of other remote systems.	Generic	test	process_creation	macos	-	Discovery Remote System Discovery	-	informational	Alejandro Ortuno, oscd.community	2020-10-22	2021-11-27	10227522-8429-47e6-a301-f2b2d014e7ad
	Detects Commandlet names from well-known PowerShell exploitation frameworks	Generic	test	ps_module	windows	PowerShell	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	CVE-2021-1675	high	Nasreddine Bencherchali (Nextron Systems)	2023-01-20	2025-12-10	7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c
	Detects Commandlet names from well-known PowerShell exploitation frameworks	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	CVE-2021-1675	high	Nasreddine Bencherchali (Nextron Systems)	2023-01-02	2025-12-10	02030f2f-6199-49ec-b258-ea71b07e03dc
	Detects Commandlet names from well-known PowerShell exploitation frameworks	Generic	test	ps_script	windows	PowerShell	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	CVE-2021-1675	high	Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer	2017-03-05	2025-12-10	89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
	Detects execution of "Net.EXE".	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Local Account Domain Account Discovery Network Share Discovery Discovery Password Policy Discovery Discovery Permission Groups Discovery Local Groups Domain Groups Lateral Movement Remote Services SMB/Windows Admin Shares Discovery Remote System Discovery Discovery System Network Connections Discovery Discovery System Service Discovery	-	low	Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)	2019-01-16	2022-07-11	183e7ea8-ac4b-4c23-9aec-b3dac4e401ac
Splunk	The following analytic identifies network traffic directed to the Active Directory Web Services Protocol (ADWS) on port 9389. (...)	Hunting	stable	network_connection	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2024-02-14	2026-05-13	68a0056c-34cb-455f-b03d-df935ea62c4f

Title

Description

Nltest S0359

Nltest MITRE reference S0359

Standing S0359

Reach

Coverage

Nltest detections S0359