SigmaHQ/rules/windows/process_creation/win_trust_discovery.yml

title: Domain Trust Discovery via Nltest.exe
description: Identifies execution of nltest.exe for domain trust discovery. This technique is used by attackers to enumerate Active Directory trusts.
status: experimental
author: E.M. Anhaus (orignally from Atomic Blue Detections, Tony Lambert)
date: 2019/10/24
tags:
    - attack.discovery
    - attack.t1482
detection:
    selection:
        Image:
            - '*nltest.exe'
        CommandLine:
            - '* domain_trusts*'
    condition: selection
falsepositives:
    - unlike
level: high
logsource:
    category: process_creation
    product: windows