Before moving laterally in a large Windows estate, an attacker needs a map. T1482, Domain Trust Discovery, is the step where they learn which domains trust which. It belongs to the discovery tactic and applies to Windows.
How attackers use it
A domain trust lets users of one domain access resources in another by using the first domain's authentication. In multi domain and forest environments, that creates paths an attacker can follow.
MITRE explains that the information gathered may help with SID history injection, pass the ticket and Kerberoasting. Trusts can be enumerated through the DSEnumerateDomainTrusts Win32 API call, .NET methods and LDAP. The Windows utility nltest is known to be used for this. MITRE's examples also include AdFind collecting organizational unit and trust information from Active Directory, and ransomware operators listing trusts with nltest.
How to detect it
MITRE's detection strategy watches for nltest, PowerShell, or Win32 and .NET API calls that enumerate trusts, including LDAP queries. The enumeration is usually followed by more discovery or by authentication staging. MITRE does not name specific event IDs for this technique.
Practical signals:
- nltest run from a workstation or server that is not an administrative host
- Command lines that ask for trusts, from user accounts that never do directory administration
- Discovery tools that enumerate trusts, then immediately query accounts or groups
- LDAP queries for trust objects from unusual sources
Process creation logging with command lines is the main data source here. Pair it with directory query telemetry where you have it.
How to reduce the risk
MITRE gives two mitigations.
- Audit. Map the trusts in your existing domains and forests and keep trust relationships to a minimum.
- Network segmentation. Segment sensitive domains.
Trusts that nobody remembers creating are the ones to find first.
Check your own environment
On a domain joined Windows host, in Command Prompt, these read-only commands list what an attacker would see.
nltest /domain_trusts
Compare the output with the trusts you expect. Then check your logs for who else has run it recently.
Quick check
Which utility does MITRE say is known to be used to enumerate domain trusts?
Nltest.
Name one mitigation MITRE lists.
Audit and minimize trust relationships, or segment sensitive domains.
