MITRE ATT&CKtechnique

T1482 Domain Trust Discovery

Published 2019-02-14 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Discovery
Platforms
Windows
Version
1.2
Created
2019-02-14

Description

Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain. Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct SID-History Injection, Pass the Ticket, and Kerberoasting. Domain trusts can be enumerated using the `DSEnumerateDomainTrusts()` Win32 API call, .NET methods, and LDAP. The Windows utility Nltest is known to be used by adversaries to enumerate domain trusts.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1047 Audit mitigation
  • M1030 Network Segmentation mitigation

Referenced by MITRE ATT&CK · uses (34)

  • S9051 The Gentlemen Ransomware software (malware)
  • S9035 LAMEHUG software (malware)
  • G1054 MirrorFace group
  • G1053 Storm-0501 group
  • G1046 Storm-1811 group
  • C0049 Leviathan Australian Intrusions campaign
  • G1043 BlackByte group
  • S1159 DUSTTRAP software (malware)
  • S1160 Latrodectus software (malware)
  • S1146 MgBot software (malware)
  • S1145 Pikabot software (malware)
  • S1124 SocGholish software (malware)
  • G1024 Akira group
  • S1081 BADHATCH software (malware)
  • S1071 Rubeus software (tool)
  • C0024 SolarWinds Compromise campaign
  • S1063 Brute Ratel C4 software (tool)
  • C0015 C0015 campaign
  • G1006 Earth Lusca group
  • S0650 QakBot software (malware)
  • S0552 AdFind software (tool)
  • S0534 Bazar software (malware)
  • S0521 BloodHound software (tool)
  • G0114 Chimera group
  • S0483 IcedID software (malware)
  • S0378 PoshC2 software (tool)
  • S0363 Empire software (tool)
  • S0359 Nltest software (tool)
  • S0266 TrickBot software (malware)
  • G0061 FIN8 group
Show all 34 ›

Referenced by Compliance · mitigates (10)

  • CIS-16.8 Separate Production and Non-Production Systems CIS Safeguard v8.1
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SA-17 Developer Security and Privacy Architecture and Design NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SC-46 Cross Domain Policy Enforcement NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control

References