tfMITRE ATT&CK technique

Domain Trust Discovery T1482

Tactic: Discovery
Platform: Windows
Version: 1.2
Created: 14 February 2019
Last modified: 12 May 2026
Contributors: Dave Westgard; Elia Florio, Microsoft; Mnemonic; RedHuntLabs, @redhuntlabs; ExtraHop

Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain.[1] Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct SID-History Injection, Pass the Ticket, and Kerberoasting.[2][3] Domain trusts can be enumerated using the DSEnumerateDomainTrusts() Win32 API call, .NET methods, and LDAP.[3] The Windows utility Nltest is known to be used by adversaries to enumerate domain trusts.[4]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 19%

Threat groups81st percentile · 81% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 12%

Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 17%

Tools & malware83rd percentile · 83% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 8%

Detection rules92nd percentile · 92% of ATT&CK techniques have this many detection rules written or fewer.

Domain Trust Discovery MITRE reference T1482

Top 19%of all ATT&CK techniques for number of groups

10 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

MirrorFaceG1054 ↗

Has run nltest.exe /domain_trusts on compromised systems to discover domain relationships.1

created 2026-04-171 referenceaka Earth Kasha

Storm-0501G1053 ↗

Has used Windows native utility Nltest nltest.exe for discovery.1

created 2025-10-191 reference

Storm-1811G1046 ↗

Has enumerated domain accounts and access during intrusions.1

created 2025-03-141 reference

BlackByteG1043 ↗

Enumerated Active Directory information and trust relationships during operations.1 2

created 2024-12-162 referencesaka Hecamede

AkiraG1024 ↗

Uses the built-in Nltest utility or tools such as AdFind to enumerate Active Directory trusts in victim environments.1

created 2024-02-201 referenceaka GOLD SAHARA

Earth LuscaG1006 ↗

Has used Nltest to obtain information about domain controllers.1

created 2022-07-011 referenceaka TAG-22

All 10 groups for this technique · 6 newest in this preview

3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

Leviathan Australian IntrusionsC0049 ↗

Leviathan performed Active Directory enumeration of victim environments during Leviathan Australian Intrusions.1

2022

C0015C0015 ↗

During C0015, the threat actors used the command nltest /domain_trusts /all_trusts to enumerate domain trusts.1

2021

SolarWinds CompromiseC0024 ↗

During the SolarWinds Compromise, APT29 used the Get-AcceptedDomain PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell.1 They also used AdFind to enumerate domains and to discover trust between federated domains.2 3

2019–2021

All 3 campaigns for this technique

20 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

LAMEHUGS9035 ↗

Can gather Active Directory domain information.1

created 2026-04-21MALWAREcarried by 1 group

LatrodectusS1160 ↗

Can run C:\Windows\System32\cmd.exe /c nltest /domain_trusts to discover domain trusts.1 2

created 2024-09-16MALWAREcarried by 2 groups

DUSTTRAPS1159 ↗

Can identify Active Directory information and related items.1

created 2024-09-16MALWAREcarried by 1 group

MgBotS1146 ↗

Includes modules for collecting information on local domain users and permissions.1

created 2024-07-25MALWAREcarried by 1 group

PikabotS1145 ↗

Will gather information concerning the Windows Domain the victim machine is a member of during execution.1

created 2024-07-12MALWAREcarried by 1 group

SocGholishS1124 ↗

Can profile compromised systems to identify domain trust relationships.1 2

created 2024-03-22MALWAREcarried by 1 group

All 20 software entries for this technique · 6 newest in this preview

Offense vs defense T1482

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 3Sigma rules (cumulative) · 17Splunk ESCU (cumulative) · 14

first rule: 2017 Q1 · 3 of 3 campaigns plotted

Domain Trust Discovery detection strategy DET0007

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Domain Trust Discovery via API, Script, and CLI Enumeration

Enterprise

1 platform

AN0016 · Windows

Adversary uses nltest, PowerShell, or Win32/.NET API to enumerate domain trust relationships (via DSEnumerateDomainTrusts, GetAllTrustRelationships, or LDAP queries), followed by discovery or authentication staging.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
Command ExecutionDC0064	WinEventLog:PowerShell	Get-ADTrust\|GetAllTrustRelationships
Active Directory Object AccessDC0071	WinEventLog:Security	EventCode=4662

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentImage	Tune based on expected script hosts or authorized administrators invoking trust enumeration.
TimeWindow	Correlate enumeration + subsequent Kerberos activity or DC interaction within a bounded window.
UserContext	Prioritize detection for non-admin or unexpected user accounts performing enumeration.
API_Name	Flag uncommon or low-prevalence API calls like DSEnumerateDomainTrusts for inspection.

Tests8Executorscmd 5 · PowerShell 3Need elevation0 of 8Have prerequisites5Have cleanup0Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Windows - Discover domain trusts with dsquery

windows

cmd

—

Windows - Discover domain trusts with nltest

windows

cmd

—

Powershell enumerate domains and forests

windows

PowerShell

—

Adfind - Enumerate Active Directory OUs

windows

cmd

—

Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory OUs reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html

Input arguments

Name	Type	Default	Description
optional_args	string	—	Allows defining arguments to add to the adfind command to tailor it to the specific needs of the environment. Use "-arg" notation to add arguments separated by spaces.

Attack command

"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -f (objectcategory=organizationalUnit) #{optional_args}

Prerequisite

AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe)

Check

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe") -ErrorAction ignore | Out-Null
Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/bin/AdFind.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe"

GUID45aeda23-2d2c-4129-81e5-a44b23f0d595

Adfind - Enumerate Active Directory Trusts

windows

cmd

—

Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Trusts reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html

Input arguments

Name	Type	Default	Description
optional_args	string	—	Allows defining arguments to add to the adfind command to tailor it to the specific needs of the environment. Use "-arg" notation to add arguments separated by spaces.

Attack command

"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -gcb -sc trustdmp

Prerequisite

AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe)

Check

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe") -ErrorAction ignore | Out-Null
Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/bin/AdFind.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe"

GUID1d9184fa-be35-4bce-b06a-f9e47b3d6654

Get-DomainTrust with PowerView

windows

PowerShell

—

Get-ForestTrust with PowerView

windows

PowerShell

—

TruffleSnout - Listing AD Infrastructure

windows

cmd

—

Iterative AD discovery toolkit for offensive operators. Situational awareness and targeted low noise enumeration. Preference for OpSec.- https://github.com/dsnezhkov/TruffleSnout

Input arguments

Name	Type	Default	Description
domain	string	%userdomain%	Domain name to search on
trufflesnout_path	path	PathToAtomicsFolder\..\ExternalPayloads\TruffleSnout.exe	Path to the TruffleSnout executable

Attack command

"#{trufflesnout_path}" forest -n #{domain}
"#{trufflesnout_path}" domain -n #{domain}

Prerequisite

TruffleSnout.exe must exist on disk at specified location (#{trufflesnout_path})

Check

if (Test-Path "#{trufflesnout_path}") {exit 0} else {exit 1}

Satisfy

New-Item -ItemType Directory (Split-Path "#{trufflesnout_path}") -Force | Out-Null
Invoke-WebRequest -Uri "https://github.com/dsnezhkov/TruffleSnout/releases/download/0.5/TruffleSnout.exe" -OutFile "#{trufflesnout_path}"

GUIDf6abc3e4-8b24-49d9-b576-9fcc6179dba8

Tests from Atomic Red Team (MIT licence) · technique definition

Domain Trust Discovery detections T1482

31 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 8%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs