tfMITRE ATT&CK technique

Domain Trust Discovery T1482

Tactic: Discovery
Platform: Windows
Version: 1.2
Created: 14 February 2019
Last modified: 12 May 2026
Contributors: Dave Westgard; Elia Florio, Microsoft; Mnemonic; RedHuntLabs, @redhuntlabs; ExtraHop

Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain.[1] Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct SID-History Injection, Pass the Ticket, and Kerberoasting.[2][3] Domain trusts can be enumerated using the DSEnumerateDomainTrusts() Win32 API call, .NET methods, and LDAP.[3] The Windows utility Nltest is known to be used by adversaries to enumerate domain trusts.[4]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 19%

Threat groups81st percentile · 80% of ATT&CK techniques have fewer threat groups attributed.

CampaignsTop 12%

Campaigns88th percentile · 83% of ATT&CK techniques have fewer campaigns recorded.

Tools & malwareTop 17%

Tools & malware83rd percentile · 82% of ATT&CK techniques have fewer tools implementing them.

Detection rulesTop 8%

Detection rules92nd percentile · 91% of ATT&CK techniques have fewer detection rules written.

Offense vs defense T1482

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 3Sigma rules (cumulative) · 17Splunk ESCU (cumulative) · 14

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
Command ExecutionDC0064	WinEventLog:PowerShell	Get-ADTrust\|GetAllTrustRelationships
Active Directory Object AccessDC0071	WinEventLog:Security	EventCode=4662

Data component

Name

Channel

Module LoadDC0016

WinEventLog:Sysmon

EventCode=7

Process CreationDC0032

WinEventLog:Sysmon

EventCode=1

Process AccessDC0035

WinEventLog:Sysmon

EventCode=10

Command ExecutionDC0064

WinEventLog:PowerShell

Get-ADTrust|GetAllTrustRelationships

Active Directory Object AccessDC0071

WinEventLog:Security

EventCode=4662

Field	What you tune
ParentImage	Tune based on expected script hosts or authorized administrators invoking trust enumeration.
TimeWindow	Correlate enumeration + subsequent Kerberos activity or DC interaction within a bounded window.
UserContext	Prioritize detection for non-admin or unexpected user accounts performing enumeration.
API_Name	Flag uncommon or low-prevalence API calls like DSEnumerateDomainTrusts for inspection.

Field

What you tune

ParentImage

Tune based on expected script hosts or authorized administrators invoking trust enumeration.

TimeWindow

Correlate enumeration + subsequent Kerberos activity or DC interaction within a bounded window.

UserContext

Prioritize detection for non-admin or unexpected user accounts performing enumeration.

API_Name

Flag uncommon or low-prevalence API calls like DSEnumerateDomainTrusts for inspection.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-03-14	2025-07-09	9212f354-7775-4e28-9c9f-8f0a4544e664
	Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. (...)	Generic	experimental	file_event	windows	Sysmon	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	medium	Arnim Rupp (Nextron Systems), Thomas Patzke	2025-07-09	—	0a1255c5-d732-4b62-ac02-b5152d34fb83
	Detects default file names outputted by the BloodHound collection tool SharpHound	Generic	test	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	C.J. May	2022-08-09	2026-02-19	02773bed-83bf-469f-b7ff-e676e7d78bab
Splunk	The following analytic detects the execution of the `Invoke-AzureHound` command-line argument, commonly used by the AzureHound tool. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-05-13	26f02e96-c300-11eb-b611-acde48001122
Splunk	The following analytic detects the creation of specific AzureHound-related files, such as `*-azurecollection.zip` and various `.json` files, on disk. (...)	Generic	stable	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-05-13	1c34549e-c31b-11eb-996b-acde48001122
Splunk	The following analytic detects the execution of SharpHound command-line arguments, specifically `-collectionMethod` and `invoke-bloodhound`. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	a0bdd2f6-c2ff-11eb-b918-acde48001122
Splunk	The following analytic detects the creation of files typically associated with SharpHound, a reconnaissance tool used for gathering domain and trust data. (...)	Generic	stable	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	42b4b438-beed-11eb-ba1d-acde48001122
Splunk	The following analytic detects the usage of the SharpHound binary by identifying its original filename, `SharpHound.exe`, and the process name. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	dd04b29a-beed-11eb-87bc-acde48001122
	Detects DNS server discovery via LDAP query requests from uncommon applications	Generic	test	dns	windows	Sysmon	Discovery Domain Trust Discovery	-	low	frack113	2022-08-20	2023-09-18	a21bcd7e-38ec-49ad-b69a-9ea17e69509e
	Detects execution of "dsquery.exe" for domain trust discovery	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery	-	medium	E.M. Anhaus, Tony Lambert, oscd.community, omkar72	2019-10-24	2023-02-02	3bad990e-4848-4a78-9530-b427d854aac0
Splunk	The following analytic detects the execution of "dsquery.exe" with arguments targeting `TrustedDomain` queries directly from the command line. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Domain Trust Discovery	-	medium	Michael Haag, Splunk	2021-03-31	2026-10-02	cc316032-924a-11eb-91a2-acde48001122
Splunk	The following analytic identifies the execution of the Get-DomainTrust command from PowerView using PowerShell, which is used to gather domain trust information. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Domain Trust Discovery	-	medium	Michael Haag, Splunk	2021-09-02	2026-10-02	4fa7f846-054a-11ec-a836-acde48001122
Splunk	The following analytic detects the execution of the Get-DomainTrust command from PowerView using PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Domain Trust Discovery	-	medium	Michael Haag, Splunk	2021-09-02	2026-05-13	89275e7e-0548-11ec-bf75-acde48001122
Splunk	The following analytic detects the execution of the Get-ForestTrust command via PowerShell, commonly used by adversaries to gather domain trust information. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Domain Trust Discovery	-	medium	Michael Haag, Splunk	2021-09-02	2026-10-02	584f4884-0bf1-11ec-a5ec-acde48001122
Splunk	The following analytic detects the execution of the Get-ForestTrust command from PowerSploit using PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery	-	medium	Michael Haag, Splunk	2021-09-02	2026-05-13	70fac80e-0bf1-11ec-9ba0-acde48001122
	Detects command line parameters used by Bloodhound and Sharphound hack tools	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	Florian Roth (Nextron Systems)	2019-12-20	2023-02-04	f376c8a7-a2d0-4ddc-aa0c-16c17236d962
	Adversaries may look for details about the network configuration and settings of systems they access (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery Discovery Network Share Discovery Discovery Permission Groups Discovery Domain Groups Discovery System Network Connections Discovery Discovery System Owner/User Discovery	-	high	frack113	2021-12-10	2023-02-14	b2317cfa-4a47-4ead-b3ff-297438c0bc2d
	Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery	-	high	frack113	2022-08-20	2023-02-13	69ca006d-b9a9-47f5-80ff-ecd4d25d481a
	Detects Commandlet names from well-known PowerShell exploitation frameworks	Generic	test	ps_module	windows	PowerShell	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	CVE-2021-1675	high	Nasreddine Bencherchali (Nextron Systems)	2023-01-20	2025-12-10	7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c
	Detects Commandlet names from well-known PowerShell exploitation frameworks	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	CVE-2021-1675	high	Nasreddine Bencherchali (Nextron Systems)	2023-01-02	2025-12-10	02030f2f-6199-49ec-b258-ea71b07e03dc
	Detects Commandlet names from well-known PowerShell exploitation frameworks	Generic	test	ps_script	windows	PowerShell	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	CVE-2021-1675	high	Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer	2017-03-05	2025-12-10	89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
Splunk	The following analytic identifies network traffic directed to the Active Directory Web Services Protocol (ADWS) on port 9389. (...)	Hunting	stable	network_connection	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2024-02-14	2026-05-13	68a0056c-34cb-455f-b03d-df935ea62c4f
Splunk	The following analytic identifies the execution of `nltest.exe` with command-line arguments `/domain_trusts` or `/all_trusts` to query Domain Trust information. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Domain Trust Discovery	-	medium	Michael Haag, Splunk	2021-01-25	2026-10-02	c3e05466-5f22-11eb-ae93-0242ac130002
	Detects nltest commands that can be used for information discovery	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery Discovery Remote System Discovery Discovery System Network Configuration Discovery	-	low	Arun Chauhan	2023-02-03	—	903076ff-f442-475a-b667-4f246bcc203b
	Detects potential Active Directory enumeration via LDAP	Generic	test	-	windows	LDAP	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	medium	Adeem Mawani	2021-06-22	2025-07-04	31d68132-4038-47c7-8f8e-635a39a7c174
	Detects nltest commands that can be used for information discovery	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery Discovery System Network Configuration Discovery	-	medium	Craig Young, oscd.community, Georg Lauenstein	2021-07-24	2023-12-15	5cc90652-4cbd-4241-aa3b-4b462fa5a248
	Detects AdFind execution with common flags seen used during attacks	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups Discovery Remote System Discovery	-	high	Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community	2021-02-02	2025-10-24	9a132afa-654e-11eb-ae93-0242ac130002
	Detects the use of a renamed Adfind.exe. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups Discovery Remote System Discovery	-	high	Florian Roth (Nextron Systems)	2022-08-21	2025-02-26	df55196f-f105-44d3-a675-e9dfb6cc2f2b
	Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database to a suspicious directory. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-03-14	2025-07-09	ef61af62-bc74-4f58-b49b-626448227652
Splunk	This analytic detects the execution of the ConvertTo-AADIntBackdoor command via PowerShell Script Block Logging. (...)	Generic	stable	ps_script	windows	PowerShell	Command and Control Application Layer Protocol Web Protocols Discovery Domain Trust Discovery Credential Access Exploitation for Credential Access Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Raven Tait, Splunk	2026-05-05	2026-10-09	59a8662f-f616-4494-8fa1-29ae77fc2018
Splunk	The following analytic detects the execution of the SOAPHound binary (`soaphound.exe`) with specific command-line arguments. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-05-13	8e53f839-e127-4d6d-a54d-a2f67044a57f

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-03-14	2025-07-09	9212f354-7775-4e28-9c9f-8f0a4544e664
	Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. (...)	Generic	experimental	file_event	windows	Sysmon	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	medium	Arnim Rupp (Nextron Systems), Thomas Patzke	2025-07-09	—	0a1255c5-d732-4b62-ac02-b5152d34fb83
	Detects default file names outputted by the BloodHound collection tool SharpHound	Generic	test	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	C.J. May	2022-08-09	2026-02-19	02773bed-83bf-469f-b7ff-e676e7d78bab
Splunk	The following analytic detects the execution of the `Invoke-AzureHound` command-line argument, commonly used by the AzureHound tool. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-05-13	26f02e96-c300-11eb-b611-acde48001122
Splunk	The following analytic detects the creation of specific AzureHound-related files, such as `*-azurecollection.zip` and various `.json` files, on disk. (...)	Generic	stable	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-05-13	1c34549e-c31b-11eb-996b-acde48001122
Splunk	The following analytic detects the execution of SharpHound command-line arguments, specifically `-collectionMethod` and `invoke-bloodhound`. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	a0bdd2f6-c2ff-11eb-b918-acde48001122
Splunk	The following analytic detects the creation of files typically associated with SharpHound, a reconnaissance tool used for gathering domain and trust data. (...)	Generic	stable	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	42b4b438-beed-11eb-ba1d-acde48001122
Splunk	The following analytic detects the usage of the SharpHound binary by identifying its original filename, `SharpHound.exe`, and the process name. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	dd04b29a-beed-11eb-87bc-acde48001122
	Detects DNS server discovery via LDAP query requests from uncommon applications	Generic	test	dns	windows	Sysmon	Discovery Domain Trust Discovery	-	low	frack113	2022-08-20	2023-09-18	a21bcd7e-38ec-49ad-b69a-9ea17e69509e
	Detects execution of "dsquery.exe" for domain trust discovery	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery	-	medium	E.M. Anhaus, Tony Lambert, oscd.community, omkar72	2019-10-24	2023-02-02	3bad990e-4848-4a78-9530-b427d854aac0
Splunk	The following analytic detects the execution of "dsquery.exe" with arguments targeting `TrustedDomain` queries directly from the command line. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Domain Trust Discovery	-	medium	Michael Haag, Splunk	2021-03-31	2026-10-02	cc316032-924a-11eb-91a2-acde48001122
Splunk	The following analytic identifies the execution of the Get-DomainTrust command from PowerView using PowerShell, which is used to gather domain trust information. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Domain Trust Discovery	-	medium	Michael Haag, Splunk	2021-09-02	2026-10-02	4fa7f846-054a-11ec-a836-acde48001122
Splunk	The following analytic detects the execution of the Get-DomainTrust command from PowerView using PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Domain Trust Discovery	-	medium	Michael Haag, Splunk	2021-09-02	2026-05-13	89275e7e-0548-11ec-bf75-acde48001122
Splunk	The following analytic detects the execution of the Get-ForestTrust command via PowerShell, commonly used by adversaries to gather domain trust information. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Domain Trust Discovery	-	medium	Michael Haag, Splunk	2021-09-02	2026-10-02	584f4884-0bf1-11ec-a5ec-acde48001122
Splunk	The following analytic detects the execution of the Get-ForestTrust command from PowerSploit using PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery	-	medium	Michael Haag, Splunk	2021-09-02	2026-05-13	70fac80e-0bf1-11ec-9ba0-acde48001122
	Detects command line parameters used by Bloodhound and Sharphound hack tools	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	Florian Roth (Nextron Systems)	2019-12-20	2023-02-04	f376c8a7-a2d0-4ddc-aa0c-16c17236d962
	Adversaries may look for details about the network configuration and settings of systems they access (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery Discovery Network Share Discovery Discovery Permission Groups Discovery Domain Groups Discovery System Network Connections Discovery Discovery System Owner/User Discovery	-	high	frack113	2021-12-10	2023-02-14	b2317cfa-4a47-4ead-b3ff-297438c0bc2d
	Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery	-	high	frack113	2022-08-20	2023-02-13	69ca006d-b9a9-47f5-80ff-ecd4d25d481a
	Detects Commandlet names from well-known PowerShell exploitation frameworks	Generic	test	ps_module	windows	PowerShell	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	CVE-2021-1675	high	Nasreddine Bencherchali (Nextron Systems)	2023-01-20	2025-12-10	7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c
	Detects Commandlet names from well-known PowerShell exploitation frameworks	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	CVE-2021-1675	high	Nasreddine Bencherchali (Nextron Systems)	2023-01-02	2025-12-10	02030f2f-6199-49ec-b258-ea71b07e03dc
	Detects Commandlet names from well-known PowerShell exploitation frameworks	Generic	test	ps_script	windows	PowerShell	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	CVE-2021-1675	high	Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer	2017-03-05	2025-12-10	89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
Splunk	The following analytic identifies network traffic directed to the Active Directory Web Services Protocol (ADWS) on port 9389. (...)	Hunting	stable	network_connection	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2024-02-14	2026-05-13	68a0056c-34cb-455f-b03d-df935ea62c4f
Splunk	The following analytic identifies the execution of `nltest.exe` with command-line arguments `/domain_trusts` or `/all_trusts` to query Domain Trust information. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Domain Trust Discovery	-	medium	Michael Haag, Splunk	2021-01-25	2026-10-02	c3e05466-5f22-11eb-ae93-0242ac130002
	Detects nltest commands that can be used for information discovery	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery Discovery Remote System Discovery Discovery System Network Configuration Discovery	-	low	Arun Chauhan	2023-02-03	—	903076ff-f442-475a-b667-4f246bcc203b
	Detects potential Active Directory enumeration via LDAP	Generic	test	-	windows	LDAP	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	medium	Adeem Mawani	2021-06-22	2025-07-04	31d68132-4038-47c7-8f8e-635a39a7c174
	Detects nltest commands that can be used for information discovery	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery Discovery System Network Configuration Discovery	-	medium	Craig Young, oscd.community, Georg Lauenstein	2021-07-24	2023-12-15	5cc90652-4cbd-4241-aa3b-4b462fa5a248
	Detects AdFind execution with common flags seen used during attacks	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups Discovery Remote System Discovery	-	high	Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community	2021-02-02	2025-10-24	9a132afa-654e-11eb-ae93-0242ac130002
	Detects the use of a renamed Adfind.exe. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups Discovery Remote System Discovery	-	high	Florian Roth (Nextron Systems)	2022-08-21	2025-02-26	df55196f-f105-44d3-a675-e9dfb6cc2f2b
	Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database to a suspicious directory. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-03-14	2025-07-09	ef61af62-bc74-4f58-b49b-626448227652
Splunk	This analytic detects the execution of the ConvertTo-AADIntBackdoor command via PowerShell Script Block Logging. (...)	Generic	stable	ps_script	windows	PowerShell	Command and Control Application Layer Protocol Web Protocols Discovery Domain Trust Discovery Credential Access Exploitation for Credential Access Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Raven Tait, Splunk	2026-05-05	2026-10-09	59a8662f-f616-4494-8fa1-29ae77fc2018
Splunk	The following analytic detects the execution of the SOAPHound binary (`soaphound.exe`) with specific command-line arguments. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-05-13	8e53f839-e127-4d6d-a54d-a2f67044a57f

Domain Trust Discovery T1482

Domain Trust Discovery T1482

Domain Trust Discovery MITRE reference T1482

Offense vs defense T1482

Domain Trust Discovery detection strategy DET0007

Detection of Domain Trust Discovery via API, Script, and CLI Enumeration

Log sources

Tunable fields

Domain Trust Discovery MITRE reference T1482

Offense vs defense T1482

Domain Trust Discovery detection strategy DET0007

Detection of Domain Trust Discovery via API, Script, and CLI Enumeration

Log sources

Tunable fields

Domain Trust Discovery detections T1482

Domain Trust Discovery detections T1482