Domain Controller Enumeration via nltest (Windows Event Log)

id: '33360.59025'
title: Domain Controller Enumeration via nltest
description: Adversaries may attempt to get a listing of other systems by IP address,
  hostname, or other logical identifier on a network that may be used for Lateral
  Movement from the current system. Functionality could exist within remote access
  tools to enable this, but utilities available on the operating system could also
  be used such as Nltest. Adversaries may look for details about the network configuration
  and settings, such as IP and/or MAC addresses, of systems they access or through
  information discovery of remote systems. Several operating system administration
  utilities exist that can be used to gather this information. Examples include Arp,
  ipconfig/ifconfig, nbtstat, and route. This use case detects nltest executions with
  options dclist or dsgetdc.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(nltest) (TERM(dclist) OR TERM(dsgetdc)) |
  table _time, host, user, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- discovery:system network configuration discovery
- discovery:remote system discovery
technique_id: 
- T1016
- T1018
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://attack.mitre.org/techniques/T1016/
- https://attack.mitre.org/techniques/T1018/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_nltest_recon.yml
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1018/T1018.md#atomic-test-3---remote-system-discovery---nltest