T1482

Domain Trust Discovery

Discovery Last updated:

Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain. Adversaries use utilities like nltest.exe, AdFind, PowerShell .NET methods (Get-ADTrust, GetAllTrustRelationships), LDAP queries, and tools like Rubeus to enumerate bidirectional, one-way, forest, and external trusts. This information facilitates SID-History Injection, Pass the Ticket, Kerberoasting, and lateral movement across trust boundaries. Widely observed in ransomware pre-encryption reconnaissance by groups including BlackByte, Akira, QakBot, IcedID, and Chimera.

What is T1482 Domain Trust Discovery?

Domain Trust Discovery (T1482) maps to the Discovery tactic — the adversary is trying to figure out your environment in MITRE ATT&CK.

This page provides production-ready detection logic for Domain Trust Discovery, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated medium severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Discovery
Technique
T1482 Domain Trust Discovery
Canonical reference
https://attack.mitre.org/techniques/T1482/
Microsoft Sentinel / Defender
kusto 
let NltestTrustArgs = dynamic([
  "/domain_trusts", "/all_trusts", "/dclist:", "/trusted_domains",
  "/domain_trusts /all_trusts"
]);
let AdfindTrustArgs = dynamic([
  "trustdmp", "trustedDomain", "objectclass=trusteddomain",
  "-f\"(objectcategory=trusteddomain)\"", "-f (objectcategory=trusteddomain)"
]);
let PsTrustPatterns = dynamic([
  "Get-ADTrust", "GetAllTrustRelationships", "DSEnumerateDomainTrusts",
  "GetCurrentDomainTrustRelationships", "GetTrustedDomains",
  "System.DirectoryServices.ActiveDirectory.Domain",
  "netapi32", "DsEnumerateDomainTrusts"
]);
let TrustBinaries = dynamic(["nltest.exe", "adfind.exe", "adfind64.exe"]);
// Branch 1: nltest.exe and AdFind direct execution
let BinaryTrustDiscovery = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (TrustBinaries)
| where ProcessCommandLine has_any (NltestTrustArgs)
    or (FileName =~"adfind.exe" and ProcessCommandLine has_any (AdfindTrustArgs))
    or (FileName =~"adfind64.exe" and ProcessCommandLine has_any (AdfindTrustArgs))
| extend TrustTool = "nltest/adfind"
| extend TrustMethod = case(
    ProcessCommandLine has "/domain_trusts", "nltest-domain_trusts",
    ProcessCommandLine has "/dclist", "nltest-dclist",
    ProcessCommandLine has "trustdmp", "adfind-trustdmp",
    ProcessCommandLine has "trusteddomain", "adfind-ldap-trust",
    "other"
);
// Branch 2: PowerShell and .NET-based trust enumeration
let PsTrustDiscovery = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (PsTrustPatterns)
| extend TrustTool = "PowerShell"
| extend TrustMethod = case(
    ProcessCommandLine has "Get-ADTrust", "ps-Get-ADTrust",
    ProcessCommandLine has "GetAllTrustRelationships", "ps-GetAllTrustRelationships",
    ProcessCommandLine has "DSEnumerateDomainTrusts", "ps-DSEnumerateDomainTrusts",
    "ps-other"
);
// Branch 3: net.exe commands revealing domain/forest info used in trust context
let NetTrustDiscovery = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("net.exe", "net1.exe")
| where ProcessCommandLine has_any ("view /domain", "group \"Domain Admins\"")
    and InitiatingProcessFileName in~ ("nltest.exe", "adfind.exe", "powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe")
| extend TrustTool = "net.exe"
| extend TrustMethod = "net-domain-enum";
union BinaryTrustDiscovery, PsTrustDiscovery, NetTrustDiscovery
| project Timestamp, DeviceName, AccountName, AccountDomain,
         FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         InitiatingProcessAccountName,
         TrustTool, TrustMethod
| sort by Timestamp desc

Detects domain trust enumeration using three branches: (1) nltest.exe and AdFind with trust-specific arguments (/domain_trusts, /all_trusts, trustdmp, objectclass=trusteddomain), (2) PowerShell and .NET methods for trust discovery (Get-ADTrust, GetAllTrustRelationships, DSEnumerateDomainTrusts), and (3) net.exe domain group/view commands spawned by known discovery parent processes. Uses union to correlate all three paths into a single result set with classification of discovery method.

medium severity high confidence

Data Sources

Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

  • Domain administrators running nltest /domain_trusts as part of AD health checks or troubleshooting connectivity between trusted domains
  • IT infrastructure monitoring tools (SolarWinds, ManageEngine AD Manager) that enumerate trust relationships for topology mapping and alerting
  • Scripted onboarding or provisioning automation that calls Get-ADTrust to validate forest membership before deploying resources
  • Penetration testing or red team exercises with pre-approved scope documents — verify against change management records
  • SIEM/SOAR playbooks that enumerate domain trusts to populate CMDB or enrich security incidents

Sigma rule & cross-platform mapping

The detection logic for Domain Trust Discovery (T1482) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1482 Sigma rules on detection.fyi

Platform-specific guides for T1482

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-19 Research depth: deep
References (10)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1nltest Domain Trust Enumeration

    Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\nltest.exe, CommandLine containing '/domain_trusts /all_trusts'. Security Event ID 4688 (if command line auditing enabled). Network traffic: LDAP queries (port 389) to the domain controller to resolve trust objects.

  2. Test 2nltest DC List Enumeration by Domain

    Expected signal: Sysmon Event ID 1: Process Create with Image=nltest.exe, CommandLine containing '/dclist:'. DNS resolution queries for _ldap._tcp.dc._msdcs.<domain> and Kerberos (port 88) or LDAP (port 389) outbound connections to domain controllers.

  3. Test 3PowerShell Get-ADTrust Domain Trust Enumeration

    Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Get-ADTrust'. PowerShell ScriptBlock Log Event ID 4104 with the full command. LDAP traffic (port 389/636) to a domain controller querying the trustedDomain object class. Security Event ID 4662 on the DC for directory object access.

  4. Test 4AdFind Trust Dump via LDAP

    Expected signal: Sysmon Event ID 1: Process Create with Image matching adfind.exe, CommandLine containing '(objectcategory=trusteddomain)'. Sysmon Event ID 3: LDAP network connection (port 389) from adfind.exe to the domain controller IP. Security Event ID 4662 on the DC showing directory object access for the trustedDomain class. File creation of adfind.exe triggers Sysmon Event ID 11 if the binary was just dropped.

  5. Test 5PowerShell .NET GetAllTrustRelationships via DirectoryServices

    Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'GetAllTrustRelationships' and 'System.DirectoryServices.ActiveDirectory.Domain'. PowerShell ScriptBlock Log Event ID 4104. Outbound LDAP connection (port 389) to a domain controller to resolve trust objects.

Response Playbook

Triage

  1. Identify the user account and host — is this a domain admin, service account, or a standard user? Standard user accounts have no legitimate reason to enumerate domain trusts; escalate immediately if a non-privileged account is involved.
  2. Examine the parent process — was nltest.exe or AdFind launched interactively by cmd.exe/PowerShell, or spawned by a suspicious parent (Office application, web browser, wscript.exe, mshta.exe)? Parent process context is the fastest way to separate legitimate admin work from post-exploitation.
  3. Check timing and context — did this activity occur during business hours on a known admin workstation, or late at night on an endpoint/server that has no administrative role? Also check whether a change ticket exists covering this activity.
  4. Review whether trust discovery is part of a broader discovery chain — look for correlated events in the preceding 30 minutes: net.exe commands, whoami, ipconfig, systeminfo, tasklist /svc, or nltest /dclist queries. A reconnaissance burst from a single host is high-confidence malicious.
  5. Correlate with authentication events — run a query against SecurityEvent for EventID 4624 (successful logon) and 4648 (explicit credential logon) from the same account around the same timestamp. New logons just before discovery events may indicate freshly compromised credentials.
  6. If AdFind is detected, examine the full command line for the LDAP filter — queries for (objectclass=trustedDomain) indicate explicit AD trust enumeration rather than a generic AdFind scan, which raises confidence significantly.

Containment

  1. If the parent process is a known malware dropper or implant (wscript, mshta, Office app), immediately isolate the endpoint via EDR network isolation to prevent lateral movement across the trusts being enumerated.
  2. If a standard user account performed the discovery, disable the account in Active Directory immediately and invalidate all active sessions (invalidate Kerberos tickets via a password reset or account disable).
  3. Block nltest.exe and AdFind.exe at the application control layer (AppLocker, WDAC) on all non-domain-controller, non-admin systems if these tools are not part of an approved toolset.
  4. If lateral movement to a trusted domain is suspected, notify the security team for that domain immediately — trusts are bidirectional threat paths and the trusted domain SOC must be alerted.
  5. Review and if necessary temporarily disable external trust relationships in AD (netdom trust /remove) to limit blast radius while the investigation is ongoing — coordinate with IT operations before doing so.

Evidence Collection

  1. Process creation logs — Sysmon Event ID 1 or Security Event ID 4688 (with command line auditing enabled via GPO) for the discovery binary and its parent process chain.
  2. Network events — Sysmon Event ID 3 for any outbound LDAP (port 389/636) or Kerberos (port 88) connections from the endpoint around the same time, which may indicate active trust exploitation following discovery.
  3. Security Event ID 4769 (Kerberos Service Ticket Request) from the domain controller — look for requests to inter-domain TGTs (krbtgt for the trusted domain) from the compromised account after discovery activity.
  4. Security Event ID 4662 (Object accessed in AD) on the domain controller — AdFind LDAP queries against the trustedDomain AD object class will generate these events.
  5. Prefetch files — C:\Windows\Prefetch\NLTEST.EXE-*.pf and ADFIND.EXE-*.pf provide first and last execution timestamps and loaded DLL lists, confirming execution even if logs have been cleared.
  6. File system artifacts — AdFind.exe is rarely pre-installed; check for the binary's presence, creation timestamp, and hash against known good to determine whether it was recently dropped by a threat actor.
  7. PowerShell ScriptBlock logs (Event ID 4104) if the activity used PowerShell — the deobfuscated script content will reveal the full trust enumeration code including any automation or persistence context.
  8. Memory forensics via EDR — capture a volatile memory snapshot of the process if still running; adversaries may pipe trust output to an in-memory data structure before exfiltration.

Escalation Criteria

  • ! Trust discovery is followed within 10 minutes by authentication attempts to hosts in a different domain — strong indicator the adversary is acting on the enumerated trust paths.
  • ! Discovery process was spawned by a known malware parent (mshta.exe, wscript.exe, regsvr32.exe, an Office application) — treat as confirmed post-exploitation and initiate incident response.
  • ! AdFind.exe or nltest.exe was dropped to disk within the last 24 hours and does not match an approved software deployment — the binary's presence alone warrants escalation.
  • ! Trust discovery is performed by a privileged account (Domain Admins, Enterprise Admins) on a non-domain-controller host with no corresponding change ticket — insider threat or credential theft scenario.
  • ! Multiple endpoints perform domain trust discovery within a short time window — suggests automated propagation (worm/ransomware pre-encryption sweep), escalate to P1 immediately.
  • ! Discovery is accompanied by LDAP queries for privileged group membership or user accounts (e.g., AdFind -f objectcategory=user) — combined reconnaissance indicates preparation for targeted lateral movement or privilege escalation.

Investigation Guide

Forensic Artifacts

  • > Registry: HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\TrustedDomainList — may be queried or modified during trust manipulation
  • > File System: C:\Windows\Prefetch\NLTEST.EXE-*.pf — execution timestamps and loaded DLL list for nltest
  • > File System: C:\Windows\Prefetch\ADFIND.EXE-*.pf — confirm AdFind execution even after binary removal
  • > Event Log: Security Event ID 4662 on domain controllers — generated when the trustedDomain AD object class is accessed via LDAP, capturing the querying account's SID
  • > Event Log: Security Event ID 4769 (Kerberos Service Ticket Requested) on domain controllers — cross-domain TGT requests following trust discovery indicate active trust exploitation
  • > Event Log: Security Event ID 4776 (NTLM authentication) on domain controllers — cross-domain NTLM authentication attempts following discovery
  • > Active Directory: CN=System,DC=domain,DC=com container — trustedDomain objects stored here; check lastModified timestamps for unauthorized changes
  • > Network: LDAP traffic (port 389/636) from non-DC endpoints to domain controllers — AdFind LDAP queries are visible in packet captures with filter 'tcp.port==389 && ldap.filter contains trusteddomain'
  • > DNS: Queries for _msdcs. subdomains of trusted domains — DNS resolution of cross-domain service records indicates active trust traversal

Tuning Guidance

The primary source of false positives is legitimate domain administrator activity. Build an allowlist based on specific account+host combinations: identify which service accounts and admin workstations legitimately run nltest.exe and on what schedule, then suppress those exact combinations rather than suppressing entire tools. For AdFind, the tool itself is not a Windows built-in and should be inventoried — if it is not part of your approved toolset, any execution is noteworthy regardless of the account. For PowerShell-based trust discovery, the Get-ADTrust cmdlet from the ActiveDirectory module is commonly used in monitoring scripts; identify the specific scripts and service accounts and allowlist those command line patterns explicitly. Raise severity to high when trust discovery is performed on a host that is not a domain controller, admin jump server, or management workstation — standard endpoints and servers have no operational need to enumerate domain trusts. Consider correlating trust discovery alerts with concurrent Kerberos TGT requests (Event ID 4768) to trusted domain krbtgt accounts on your domain controllers as an automated escalation rule — this indicates the adversary has moved from reconnaissance to active exploitation.

Hunting Queries

Hunt for accounts or hosts running nltest.exe multiple times or across multiple systems in the past 7 days. A single administrator running nltest once on their workstation is benign; repeated execution or execution across multiple hosts is a strong signal of automated reconnaissance or lateral movement.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "nltest.exe"
| summarize
    CommandLines=make_set(ProcessCommandLine),
    Hosts=dcount(DeviceName),
    Users=dcount(AccountName),
    FirstSeen=min(Timestamp),
    LastSeen=max(Timestamp),
    Count=count()
  by AccountName, DeviceName
| where Count > 1 or Hosts > 1
| sort by Count desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\nltest.exe"
| stats count as Count, dc(host) as Hosts, dc(User) as Users, values(CommandLine) as CommandLines, earliest(_time) as FirstSeen, latest(_time) as LastSeen by User, host
| where Count > 1 OR Hosts > 1
| sort - Count

Hunt for hosts where domain trust discovery is part of a broader reconnaissance burst — joining trust enumeration commands with other discovery commands (whoami, ipconfig, systeminfo, net user) within the same 30-minute window. This pattern is characteristic of automated post-exploitation frameworks (Empire, Cobalt Strike, QakBot) running a discovery module sequence.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("nltest.exe", "adfind.exe", "adfind64.exe", "powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("/domain_trusts", "/all_trusts", "trustdmp", "Get-ADTrust", "GetAllTrustRelationships", "DSEnumerateDomainTrusts")
// Look for broader recon chain on the same device within the same 30-min window
| extend ReconWindowStart = bin(Timestamp, 30m)
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | where ProcessCommandLine has_any ("whoami", "ipconfig", "systeminfo", "net user", "net group", "tasklist", "nltest /dclist")
    | extend ReconWindowStart = bin(Timestamp, 30m)
    | project DeviceName, ReconWindowStart, FollowOnCmd=ProcessCommandLine
  ) on DeviceName, ReconWindowStart
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, FollowOnCmd
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (CommandLine="*/domain_trusts*" OR CommandLine="*trustdmp*" OR CommandLine="*Get-ADTrust*" OR CommandLine="*GetAllTrustRelationships*")
| eval recon_bucket=strftime(round(_time/1800)*1800, "%Y-%m-%d %H:%M")
| stats values(CommandLine) as TrustCmds, values(Image) as Tools by host, User, recon_bucket
| join host recon_bucket [
    search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
      (CommandLine="*whoami*" OR CommandLine="*ipconfig*" OR CommandLine="*systeminfo*" OR CommandLine="*net user*" OR CommandLine="*tasklist*")
    | eval recon_bucket=strftime(round(_time/1800)*1800, "%Y-%m-%d %H:%M")
    | stats values(CommandLine) as OtherReconCmds by host, recon_bucket
  ]
| table recon_bucket, host, User, TrustCmds, OtherReconCmds
| sort - recon_bucket

Hunt for nltest.exe or AdFind executed by unexpected parent processes. Legitimate admin use almost always originates from cmd.exe, PowerShell, or explorer.exe. Discovery tools spawned by document readers (winword.exe, excel.exe), script hosts (wscript.exe, mshta.exe, cscript.exe), browsers, or network services are high-confidence indicators of malware-driven reconnaissance.

Hunting — KQL
kql 
// Hunt for nltest or AdFind spawned by suspicious parents (not cmd.exe, powershell.exe from admin accounts)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("nltest.exe", "adfind.exe", "adfind64.exe")
| where InitiatingProcessFileName !in~ (
    "cmd.exe", "powershell.exe", "pwsh.exe", "explorer.exe",
    "mmc.exe", "services.exe"
  )
| project Timestamp, DeviceName, AccountName,
         FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\nltest.exe" OR Image="*\\adfind.exe" OR Image="*\\adfind64.exe")
  NOT (ParentImage="*\\cmd.exe" OR ParentImage="*\\powershell.exe" OR ParentImage="*\\pwsh.exe"
       OR ParentImage="*\\explorer.exe" OR ParentImage="*\\mmc.exe" OR ParentImage="*\\services.exe")
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine
| sort - _time

Atomic Red Team Tests

Test 1 nltest Domain Trust Enumeration
windows

Uses nltest.exe, a built-in Windows utility, to enumerate domain trust relationships. The /domain_trusts flag lists all trusted domains known to the current domain. This exact command is observed in QakBot, IcedID, Bazar, Chimera, and Akira intrusions. The /all_trusts flag extends enumeration to include forest-level trusts.

Command

powershell 
nltest /domain_trusts /all_trusts

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\nltest.exe, CommandLine containing '/domain_trusts /all_trusts'. Security Event ID 4688 (if command line auditing enabled). Network traffic: LDAP queries (port 389) to the domain controller to resolve trust objects.

Expected Detection

Alert fires on nltest.exe with /domain_trusts argument match. KQL: TrustMethod='nltest-domain_trusts'. SPL: TrustScore=1, TrustMethod='nltest-domain_trusts'.

Test 2 nltest DC List Enumeration by Domain
windows

Uses nltest.exe /dclist to enumerate domain controllers for a specified domain. Adversaries run this after trust discovery to identify which DCs are reachable in a trusted domain, enabling targeted Kerberos attacks. Replace 'contoso.local' with your lab domain name for accurate testing.

Command

powershell 
nltest /dclist:contoso.local

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=nltest.exe, CommandLine containing '/dclist:'. DNS resolution queries for _ldap._tcp.dc._msdcs.<domain> and Kerberos (port 88) or LDAP (port 389) outbound connections to domain controllers.

Expected Detection

Alert fires on nltest.exe with /dclist argument. KQL: TrustMethod='nltest-dclist'. SPL: NltestTrust=1, TrustMethod='nltest-dclist'.

Test 3 PowerShell Get-ADTrust Domain Trust Enumeration
windows

Uses the PowerShell ActiveDirectory module's Get-ADTrust cmdlet to enumerate all trust relationships for the current domain. This .NET-based method is used by Empire, PowerView, and custom attacker scripts to enumerate trusts programmatically, often with output piped to a collection variable or exfiltrated in-memory.

Command

powershell 
powershell.exe -NoProfile -Command "Import-Module ActiveDirectory; Get-ADTrust -Filter * | Select-Object Name, Direction, TrustType, TrustAttributes"

Expected Telemetry

Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Get-ADTrust'. PowerShell ScriptBlock Log Event ID 4104 with the full command. LDAP traffic (port 389/636) to a domain controller querying the trustedDomain object class. Security Event ID 4662 on the DC for directory object access.

Expected Detection

Alert fires on PowerShell with Get-ADTrust pattern. KQL: TrustMethod='ps-Get-ADTrust'. SPL: PsTrust=1, TrustMethod='ps-Get-ADTrust'.

Test 4 AdFind Trust Dump via LDAP
windows

Uses AdFind.exe (commonly dropped by ransomware precursor malware including Ryuk/Conti, BlackByte, and Akira) to query Active Directory for all trustedDomain objects via the 'trustdmp' shortcut or direct LDAP filter. AdFind must be downloaded and placed in a test directory. This simulates the exact technique observed in major ransomware intrusions.

Command

powershell 
C:\Tools\AdFind.exe -f "(objectcategory=trusteddomain)" -dn

Expected Telemetry

Sysmon Event ID 1: Process Create with Image matching adfind.exe, CommandLine containing '(objectcategory=trusteddomain)'. Sysmon Event ID 3: LDAP network connection (port 389) from adfind.exe to the domain controller IP. Security Event ID 4662 on the DC showing directory object access for the trustedDomain class. File creation of adfind.exe triggers Sysmon Event ID 11 if the binary was just dropped.

Expected Detection

Alert fires on adfind.exe with trusteddomain LDAP filter. KQL: TrustMethod='adfind-ldap-trust'. SPL: AdfindTrust=1, TrustMethod='adfind-ldap-trust'.

Test 5 PowerShell .NET GetAllTrustRelationships via DirectoryServices
windows

Uses the System.DirectoryServices.ActiveDirectory .NET namespace to enumerate domain trusts without relying on the ActiveDirectory module — a technique used by adversaries on systems where RSAT is not installed. This approach calls the same Win32 DSEnumerateDomainTrusts API via managed code and is characteristic of PowerShell-based implants.

Command

powershell 
powershell.exe -NoProfile -Command "[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().GetAllTrustRelationships()"

Expected Telemetry

Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'GetAllTrustRelationships' and 'System.DirectoryServices.ActiveDirectory.Domain'. PowerShell ScriptBlock Log Event ID 4104. Outbound LDAP connection (port 389) to a domain controller to resolve trust objects.

Expected Detection

Alert fires on PowerShell with GetAllTrustRelationships pattern. KQL: TrustMethod='ps-GetAllTrustRelationships'. SPL: PsTrust=1, TrustMethod='ps-GetAllTrustRelationships'.

Related Detections

Tactic Hub

TA0007Discovery

Related Techniques

T1087.002Domain AccountT1069.002Domain GroupsT1550.003Pass the TicketT1134.005SID-History InjectionT1558.003KerberoastingT1615Group Policy DiscoveryT1016System Network Configuration DiscoveryT1021.002SMB/Windows Admin SharesT1059.001PowerShell

Same Tactic: Discovery

Popular Detections