EXPLORE
← Back to Explore
T1482

Domain Trust Discovery

Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain.(Citation: Microsoft Trusts) Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct [SI...

Windows
38
Detections
3
Sources
9
Threat Actors

BY SOURCE

17sigma13splunk_escu8elastic

PROCEDURES (24)

Process Creation Monitoring7 detections

Auto-extracted: 7 detections for process creation monitoring

General Monitoring3 detections

Auto-extracted: 3 detections for general monitoring

Lateral3 detections

Auto-extracted: 3 detections for lateral

Script Block2 detections

Auto-extracted: 2 detections for script block

Spray2 detections

Auto-extracted: 2 detections for spray

Powershell2 detections

Auto-extracted: 2 detections for powershell

Powershell2 detections

Auto-extracted: 2 detections for powershell

Azure1 detections

Auto-extracted: 1 detections for azure

Lateral1 detections

Auto-extracted: 1 detections for lateral

Lateral1 detections

Auto-extracted: 1 detections for lateral

Remote1 detections

Auto-extracted: 1 detections for remote

Powershell1 detections

Auto-extracted: 1 detections for powershell

Credential1 detections

Auto-extracted: 1 detections for credential

Service1 detections

Auto-extracted: 1 detections for service

Privilege1 detections

Auto-extracted: 1 detections for privilege

Remote1 detections

Auto-extracted: 1 detections for remote

Service1 detections

Auto-extracted: 1 detections for service

Credential1 detections

Auto-extracted: 1 detections for credential

Service Monitoring1 detections

Auto-extracted: 1 detections for service monitoring

Spray1 detections

Auto-extracted: 1 detections for spray

File Monitoring1 detections

Auto-extracted: 1 detections for file monitoring

Cloud Monitoring1 detections

Auto-extracted: 1 detections for cloud monitoring

Lateral1 detections

Auto-extracted: 1 detections for lateral

Azure1 detections

Auto-extracted: 1 detections for azure

DETECTIONS (38)

Active Directory Database Snapshot Via ADExplorer
sigmamedium
Active Directory Discovery using AdExplorer
elasticlow
ADExplorer Writing Complete AD Snapshot Into .dat File
sigmamedium
AdFind Command Activity
elasticlow
BloodHound Collection Files
sigmahigh
Detect AzureHound Command-Line Arguments
splunk_escu
Detect AzureHound File Modifications
splunk_escu
Detect SharpHound Command-Line Arguments
splunk_escu
Detect SharpHound File Modifications
splunk_escu
Detect SharpHound Usage
splunk_escu
DNS Server Discovery Via LDAP Query
sigmalow
Domain Trust Discovery Via Dsquery
sigmamedium
DSQuery Domain Discovery
splunk_escu
Enumerating Domain Trusts via DSQUERY.EXE
elasticlow
Enumerating Domain Trusts via NLTEST.EXE
elasticlow
Get-DomainTrust with PowerShell
splunk_escu
Get-DomainTrust with PowerShell Script Block
splunk_escu
Get-ForestTrust with PowerShell
splunk_escu
Get-ForestTrust with PowerShell Script Block
splunk_escu
HackTool - Bloodhound/Sharphound Execution
sigmahigh
HackTool - SharpView Execution
sigmahigh
HackTool - TruffleSnout Execution
sigmahigh
Malicious PowerShell Commandlets - PoshModule
sigmahigh
Malicious PowerShell Commandlets - ProcessCreation
sigmahigh
Malicious PowerShell Commandlets - ScriptBlock
sigmahigh
Network Traffic to Active Directory Web Services Protocol
splunk_escu
NLTest Domain Trust Discovery
splunk_escu
Nltest.EXE Execution
sigmalow
Potential Active Directory Reconnaissance/Enumeration Via LDAP
sigmamedium
Potential PowerShell HackTool Script by Function Names
elasticmedium
Potential Recon Activity Via Nltest.EXE
sigmamedium
PowerShell Suspicious Discovery Related Windows API Functions
elasticlow
PUA - AdFind Suspicious Execution
sigmahigh
Renamed AdFind Execution
sigmahigh
Suspicious Access to LDAP Attributes
elasticlow
Suspicious Active Directory Database Snapshot Via ADExplorer
sigmahigh
Suspicious JetBrains TeamCity Child Process
elasticmedium
Windows SOAPHound Binary Execution
splunk_escu