T1482 Domain Trust Discovery
Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. MITRE ATT&CK
11 Sigma rules T1482 on attack.mitre.org
Sigma rules tagged with it
highMalicious PowerShell Commandlets - ProcessCreationNasreddine Bencherchali (Nextron Systems) · Windows
highPUA - AdFind Suspicious ExecutionJanantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community · Windows
highSuspicious Active Directory Database Snapshot Via ADExplorerNasreddine Bencherchali (Nextron Systems) · Windows
mediumActive Directory Database Snapshot Via ADExplorerNasreddine Bencherchali (Nextron Systems) · Windows
mediumDomain Trust Discovery Via DsqueryE.M. Anhaus, Tony Lambert, oscd.community, omkar72 · Windows
mediumPotential Recon Activity Via Nltest.EXECraig Young, oscd.community, Georg Lauenstein · Windows
Command lines CmdID reads as it
Suspend a workflow job by name on the page for Suspend-Job
#Sample Workflow
workflow Get-SystemLog
{
$Events = Get-WinEvent -LogName System
CheckPoint-Workflow
inlinescript {\\Server01\Scripts\Analyze-SystemEvents.ps1 -Events $Events}
}
Get-SystemLog -AsJob -JobName "LogflowJob"
Get-Job -Name LogflowJobIdentifyAn example is here when CmdID’s reading of it names T1482: a Sigma rule it trips is tagged with it, or its abuse is documented as it.