Nltest execution enumerating domain trust relationships

Siemphony@siemphonymediumT1482unverified

Matches nltest.exe run with a trust-enumeration switch, the CLI leg of AN0016 and the one MITRE calls out by name as adversary tradecraft. The rule is written on Sysmon EventID 1 (`Image`, `CommandLine`) rather than the brief's Security 4662 alternative, because 4662 requires a SACL on the directory object and records the access, not the command that made it. This selector cannot see the other two paths the same analytic names: PowerShell's Get-ADTrust/GetAllTrustRelationships cmdlets and a direct DSEnumerateDomainTrusts()/LDAP call from a compiled tool leave no nltest process at all, so a quiet result here says nothing about those. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0007, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (FolderPath endswith "\\nltest.exe" and (ProcessCommandLine contains "/domain_trusts" or ProcessCommandLine contains "/trusted_domains" or ProcessCommandLine contains "/all_trusts"))

Splunk · SPL

Run this as a search.

index=* (Image="*\\nltest.exe" AND (CommandLine="*/domain_trusts*" OR CommandLine="*/trusted_domains*" OR CommandLine="*/all_trusts*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*\\\\nltest.exe" AND (TO_LOWER(process.command_line) LIKE "*/domain_trusts*" OR TO_LOWER(process.command_line) LIKE "*/trusted_domains*" OR TO_LOWER(process.command_line) LIKE "*/all_trusts*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\nltest\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(/domain_trusts|/trusted_domains|/all_trusts)</field>    <description>Nltest execution enumerating domain trust relationships</description>    <mitre>      <id>T1482</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: network_service_discovery
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: eec1a4d7-5b35-49a8-8cec-8c3b5037b672

ATT&CKT1482

T1482Domain Trust Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonnetwork service discovery

network service discoveryAI draft — unreviewed

01 · What this rule detects

AN0016 names three ways an adversary enumerates domain trusts: the nltest.exe CLI, PowerShell's Get-ADTrust/GetAllTrustRelationships cmdlets, and a direct DSEnumerateDomainTrusts()/LDAP call from a compiled tool. This rule matches exactly one of those three — nltest.exe run with a trust-enumeration switch — because it is the leg MITRE calls out by name as adversary tradecraft and the only one with a concrete process-creation observable. This is a textbook case of precursor-only, single-leg coverage: Sigma has no way to join across the other two paths from a single event, so the honest scope is "this CLI tool was used," not "trust enumeration happened."

02 · Telemetry you need

Sysmon EventID 1, category: process_creation / product: windows, giving Image and CommandLine. AN0016 also offers Security EventID 4662 (Active Directory object access) as an alternate log source, and the rule deliberately skips it — worth walking through why, since it's a reasoning pattern that recurs across this corpus. 4662 requires a SACL placed on the directory object and records that access occurred, not the command that caused it. A quiet 4662 feed doesn't mean no enumeration happened; it means the SACL was never configured, or the access simply wasn't logged in a way that names the actor's tool. Process creation, by contrast, directly records that nltest.exe ran — a stronger, cheaper signal for this specific leg.

03 · How the logic works

Two selections, ANDed: selection_image matches Image|endswith: '\nltest.exe'; selection_switch matches CommandLine|contains one of /domain_trusts, /trusted_domains, or /all_trusts. All three are real nltest switches that enumerate trust relationships rather than, say, querying a single domain controller's status, so the selector is scoped to the behaviour the analytic describes rather than to nltest.exe usage in general. The coverage gap is the lesson here. A reviewer confirmed the rule is "clean, well-grounded" on what it does cover, but flagged explicitly that PowerShell's AD cmdlets and a compiled tool calling DSEnumerateDomainTrusts() or raw LDAP directly — both named in the same AN0016 analytic — leave no nltest.exe process at all and are completely invisible here. The rule's own description says as much: "a quiet result here says nothing about those." That's not a hedge, it's the actual shape of the rule's coverage, and it matters because SharpHound-style AD collection tooling — a common real-world path for exactly this kind of enumeration — uses LDAP directly and never touches nltest.exe.

04 · Common false positives

Both false positives are administrative, not attacker-adjacent: AD administrators and helpdesk staff running nltest by hand to troubleshoot a broken trust or confirm reachability to a trusted forest — using the exact switches this rule matches, because that's what the runbook tells them to run; and scheduled AD health-check tooling (SCOM management packs, in-house PowerShell) that shells out to nltest /domain_trusts on a timer. Neither claims dominant volume, consistent with level: medium.

05 · Detection maturity

tier_1: . Derived from a MITRE scaffold with no query logic, never run against a log line. The 4662-versus-process-creation reasoning is sound analysis but untested against a real SACL-configured environment.
tier_2: means confirming `nltest` switch usage patterns against real admin traffic to size the exclusion list.
tier_3: ** means building and correlating the PowerShell and LDAP legs so the technique, not just one tool, has coverage.

Tuning & false positivesexperimental · 2 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

If your environment has a small, known set of hosts that run scheduled trust-health checks, exclude them by host or by the parent process the scheduler uses. Beyond that, the honest tuning move isn't inside this rule — it's building the companion selectors this analytic actually calls for: a PowerShell operational-log rule matching Get-ADTrust/GetAllTrustRelationships, and, if LDAP query auditing is ever enabled, a rule against that. Without those, this rule alone should not be read as "trust enumeration coverage" — only "nltest coverage."

Declared by the author

Active Directory administrators and helpdesk staff running nltest by hand to troubleshoot a broken trust or confirm a domain controller can reach a trusted forest — the exact switches this rule matches are the ones a runbook tells them to use.
Scheduled AD health-check and monitoring scripts (SCOM management packs, in-house PowerShell) that shell out to nltest /domain_trusts on a timer to verify trust health across a forest.

Noise checkfires on 1 of 30

Fires on 1 of 30 ordinary behaviours the baseline holds for this log type. Each is something a managed estate does on purpose, so each is a false positive an analyst would have to close.

pc-nltest-domain-trusts
Directory health monitoring enumerating trusts on a schedule.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Not verified

Security Datasets — Domain trust discovery
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
0 true · 1 false · 100.0% noise

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1482, evaluated against their process_creation events.

Share this rule

/u/siemphony/eec1a4d7-5b35-49a8-8cec-8c3b5037b672

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Nltest execution enumerating domain trust relationships

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it