Domain Trust Discovery Commands - Windows (PowerShell)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. This use case detects executions of domain trust discovery commands used with nltest.exe. nltest.exe is not included in the detection to account for instances where nltest.exe has been renamed

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1482` Domain Trust Discovery

References

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

id: '22209.39130'
title: Domain Trust Discovery Commands - Windows
description: 'Adversaries may attempt to gather information on domain trust relationships
  that may be used to identify lateral movement opportunities in Windows multi-domain/forest
  environments. This use case detects executions of domain trust discovery commands
  used with nltest.exe. nltest.exe is not included in the detection to account for
  instances where nltest.exe has been renamed. -- Software Association: Play -- Atomics
  T1482 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") ("/domain_trusts" OR "/trusted_domains") | table _time, host,
  user, process, process_*, parent_* | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- discovery:domain trust discovery
technique_id: 
- T1482
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md#atomic-test-2---windows---discover-domain-trusts-with-nltest

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR "<EventID>4104<") ("/domain_trusts" OR "/trusted_domains")

Stage 2: `table`

| table _time, host, user, process, process_*, parent_*

Stage 3: `bucket`

| bin span=1s

Stage 4: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4104` corpus 269 (splunk 269)	`field:"EventID" kind:eq value:"4104"`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>4104<"`
1	`"/domain_trusts"`
1	`"/trusted_domains"`