Detect Network Trust Dependencies in Google Chronicle

rule t1590_003_network_trust_dependency_enumeration {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects enumeration of Active Directory trust relationships via process execution or LDAP directory access. Covers nltest.exe, netdom.exe, PowerShell AD cmdlets, dsquery.exe, and Event ID 4662 trustedDomain object access (T1590.003)."
    mitre_attack_tactic = "Reconnaissance"
    mitre_attack_technique = "T1590.003"
    severity = "MEDIUM"
    priority = "MEDIUM"

  events:
    (
      // Branch 1a: nltest.exe with trust enumeration arguments
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and re.regex($e.target.process.file.full_path, `(?i)\\nltest\.exe$`)
        and (
          re.regex($e.target.process.command_line, `(?i)/domain_trusts`) or
          re.regex($e.target.process.command_line, `(?i)/all_trusts`) or
          re.regex($e.target.process.command_line, `(?i)/trusted_domains`) or
          re.regex($e.target.process.command_line, `(?i)/dclist`) or
          re.regex($e.target.process.command_line, `(?i)/parentdomain`) or
          re.regex($e.target.process.command_line, `(?i)/dsgetsite`)
        )
      )
      or
      // Branch 1b: netdom.exe trust operations
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and re.regex($e.target.process.file.full_path, `(?i)\\netdom\.exe$`)
        and (
          re.regex($e.target.process.command_line, `(?i)(trust|query|enumerate_principals)`)
        )
      )
      or
      // Branch 1c: PowerShell AD trust cmdlets
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and re.regex($e.target.process.file.full_path, `(?i)\\(powershell|pwsh)\.exe$`)
        and (
          re.regex($e.target.process.command_line, `(?i)(Get-ADTrust|Get-ADForest|Get-ADDomain)`) or
          re.regex($e.target.process.command_line, `(?i)(trustedDomain|trustDirection|trustAttributes)`) or
          re.regex($e.target.process.command_line, `(?i)(DsEnumerateDomainTrusts|NetEnumerateTrustedDomains)`)
        )
      )
      or
      // Branch 1d: dsquery.exe targeting trust objects
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and re.regex($e.target.process.file.full_path, `(?i)\\dsquery\.exe$`)
        and re.regex($e.target.process.command_line, `(?i)(trustedDomain|trust)`)
      )
      or
      // Branch 2: LDAP directory access to trustedDomain objects (Event ID 4662)
      (
        $e.metadata.event_type = "USER_RESOURCE_ACCESS"
        and $e.metadata.product_event_type = "4662"
        and (
          re.regex($e.target.resource.name, `(?i)(trustedDomain|domainDNS)`)
        )
      )
    )

  condition:
    $e
}