This note documents detection patterns related to Domain Trust Enumeration within Active Directory environments.
Direct Indicators
| Log | Event ID | Meaning | Forensic Value | Notes |
|---|---|---|---|---|
| Security | 4662 | Directory object accessed | High | LDAP queries retrieving trust relationship objects. |
| Security | 4624 | Successful logon | Medium | Authentication used during enumeration. |
| Security | 4648 | Explicit credentials used | High | Tools authenticating with alternate credentials. |
| Sysmon | 1 | Process creation | High | Execution of enumeration tools. |
| Sysmon | 3 | Network connection | Medium | LDAP queries to domain controllers. |
Indirect Indicators
| Indicator | What To Look For | Forensic Value | Notes |
|---|---|---|---|
| LDAP queries for trust objects | Queries against trustedDomain objects | High | Indicates trust enumeration. |
| Enumeration tools execution | PowerView or nltest usage | High | Direct discovery activity. |
| Multiple domain controller queries | Repeated LDAP requests | Medium | Automated enumeration behavior. |
Common Tools
| Tool | Usage |
|---|---|
| PowerView | Enumerates domain trust relationships. |
| nltest | Native tool for listing domain trusts. |
| SharpHound | Collects trust relationship data. |
| BloodHound.py | Enumerates trust data from Linux. |
Relevant Artifacts
- Security logs (4662, 4624, 4648)
- LDAP query telemetry
- Sysmon process logs
- EDR telemetry
- Network logs to domain controllers
MITRE ATT&CK References
- T1482 Domain Trust Discovery
Decision Tree
- Detect enumeration-related process execution.
- Identify querying host.
- Inspect LDAP query types.
- Determine authenticated account.
- Identify scope of trust relationships discovered.
Example Detection Templates
KQL
SecurityEvent
| where EventID == 4662
EQL
any where event.code == "4662"
Sigma
title: Domain Trust Enumeration
logsource:
product: windows
service: security
detection:
selection:
EventID: 4662
condition: selection
level: medium
Mitigation & Hardening
| Control Area | Mitigation | Effectiveness | Notes |
|---|---|---|---|
| Monitoring | Alert on trust enumeration commands | Medium | Identifies reconnaissance. |
| Audit logging | Enable directory access auditing | High | Improves visibility. |
| Least privilege | Limit domain query capabilities | Low | Enumeration often allowed. |