T1482 Domain Trust Discovery
Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain.(Citation: Microsoft Trusts) Domain trusts allow the users of the trusted domain to…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- BloodHound Collection Fileshightest · windows
- HackTool - Bloodhound/Sharphound Executionhightest · windows
- HackTool - SharpView Executionhightest · windows
- HackTool - TruffleSnout Executionhightest · windows
- Malicious PowerShell Commandlets - PoshModulehightest · windows
- Malicious PowerShell Commandlets - ProcessCreationhightest · windows
- Malicious PowerShell Commandlets - ScriptBlockhightest · windows
- PUA - AdFind Suspicious Executionhightest · windows
- Renamed AdFind Executionhightest · windows
- Suspicious Active Directory Database Snapshot Via ADExplorerhightest · windows
- Active Directory Database Snapshot Via ADExplorermediumtest · windows
- Domain Trust Discovery Via Dsquerymediumtest · windows
- Potential Active Directory Reconnaissance/Enumeration Via LDAPmediumtest · windows
- Potential Recon Activity Via Nltest.EXEmediumtest · windows
- ADExplorer Writing Complete AD Snapshot Into .dat Filemediumexperimental · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.