T1482 — Domain Trust Discovery

Tactic: Discovery · Platforms: Windows

Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of…

Sigma detection rules (1)

T1482 Domain Trust Discovery

title: T1482 Domain Trust Discovery
id: f057cadb-3824-40eb-af89-d8b13aea007a
description: 'Detection of Domain Trust Discovery via API, Script, and CLI Enumeration. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: ParentImage, TimeWindow, UserContext, API_Name.'
references:
  - https://attack.mitre.org/techniques/T1482
author: Shahrukh Khan
date: 2026-03-06
license: MIT
tags:
  - attack.discovery
  - attack.t1482

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_nltest:
    Image|endswith: '\nltest.exe'
    CommandLine|contains:
      - '/domain_trusts'
      - '/trusted_domains'
      - '/all_trusts'
  selection_dsquery:
    Image|endswith: '\dsquery.exe'
    CommandLine|contains: 'trustdmp'
  selection_powershell:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Get-ADTrust'
      - 'Get-AcceptedDomain'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: 1 of selection_* and not filter_system_account

falsepositives:
  - Legitimate AD administration, domain trust audits, or scripted health checks.

level: medium

Explore