Techniques › T1482 › AN0016
AN0016 Analytic 0016
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Adversary uses nltest, PowerShell, or Win32/.NET API to enumerate domain trust relationships (via DSEnumerateDomainTrusts, GetAllTrustRelationships, or LDAP queries), followed by discovery or authentication staging.</p>
- Detects
- T1482 Domain Trust Discovery
- Part of
- DET0007 Detection of Domain Trust Discovery via API, Script, and CLI Enumeration
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
| WinEventLog:Sysmon | EventCode=10 | DC0035 Process Access |
| WinEventLog:PowerShell | Get-ADTrust|GetAllTrustRelationships | DC0064 Command Execution |
| WinEventLog:Security | EventCode=4662 | DC0071 Active Directory Object Access |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ParentImage | Tune based on expected script hosts or authorized administrators invoking trust enumeration. |
TimeWindow | Correlate enumeration + subsequent Kerberos activity or DC interaction within a bounded window. |
UserContext | Prioritize detection for non-admin or unexpected user accounts performing enumeration. |
API_Name | Flag uncommon or low-prevalence API calls like DSEnumerateDomainTrusts for inspection. |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2022-41082 | Microsoft Exchange Server | Mapped |
| CVE-2023-22952 | SugarCRM Multiple Products | Stale |