T1482 · Domain Trust Discovery

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1482 · Domain Trust Discovery · Sunturai

attack-patternenterprise-attackT1482

Domain Trust Discovery

attack-pattern--767dbf9e-df3f-45cb-8998-4903ab5f80c0

Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain.(Citation: Microsoft Trusts) Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct SID-History Injection, Pass the Ticket, and Kerberoasting.(Citation: AdSecurity Forging Trust Tickets) (Citation: Harmj0y Domain Trusts) Domain trusts can be enumerated using the `DSEnumerateDomainTrusts()` Win32 API call, .NET methods, and LDAP.(Citation: Harmj0y Domain Trusts) The Windows utility Nltest is known to be used by adversaries to enumerate domain trusts.(Citation: Microsoft Operation Wilysupply)

Created: Feb 14, 2019, 4:15 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

43 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script	Medium	Splunk security content	Oct 13, 2026	Apache License 2.0
NLTest Domain Trust Discovery	Medium	Splunk security content	Oct 13, 2026	Apache License 2.0
Get-ForestTrust with PowerShell	Medium	Splunk security content	Oct 13, 2026	Apache License 2.0
Get-DomainTrust with PowerShell	Medium	Splunk security content	Oct 13, 2026	Apache License 2.0
DSQuery Domain Discovery	Medium	Splunk security content	Oct 13, 2026	Apache License 2.0
Detect SharpHound Usage	Medium	Splunk security content	Oct 13, 2026	Apache License 2.0
Detect SharpHound File Modifications	Medium	Splunk security content	Oct 13, 2026	Apache License 2.0
Detect SharpHound Command-Line Arguments	Medium	Splunk security content	Oct 13, 2026	Apache License 2.0
AdFind Command Activity	Low	Elastic detection rules	Oct 8, 2026	Elastic License 2.0
Suspicious JetBrains TeamCity Child Process	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential PowerShell HackTool Script by Function Names	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
PowerShell Suspicious Discovery Related Windows API Functions	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Access to LDAP Attributes	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Enumerating Domain Trusts via NLTEST.EXE	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Enumerating Domain Trusts via DSQUERY.EXE	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Active Directory Discovery using AdExplorer	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Enumeration using Adfind Tool	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Dev-0270 WMIC Discovery	High	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Powershell Empire Cmdlets Executed in Command Line	Medium	Microsoft Sentinel analytics	Aug 29, 2026	MIT License
Probable AdFind Recon Tool Usage	High	Microsoft Sentinel analytics	Aug 29, 2026	MIT License
Windows SOAPHound Binary Execution	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Network Traffic to Active Directory Web Services Protocol	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Get-ForestTrust with PowerShell Script Block	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Get-DomainTrust with PowerShell Script Block	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Detect AzureHound File Modifications	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0

Showing 25 of 43

Filter in the catalogue

External references

mitre-attackT1482Open reference

Microsoft Operation WilysupplyOpen reference

AdSecurity Forging Trust TicketsOpen reference

Microsoft TrustsOpen reference

Microsoft GetAllTrustRelationshipsOpen reference

Harmj0y Domain TrustsOpen reference

Platforms

Windows

Kill chain phases

discovery

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object