{"id":"5cc90652-4cbd-4241-aa3b-4b462fa5a248","title":"Potential Recon Activity Via Nltest.EXE","description":"Detects nltest commands that can be used for information discovery","author":"Craig Young, oscd.community, Georg Lauenstein","status":"test","level":"medium","date":"2021-07-24","modified":"2023-12-15","tags":["attack.discovery","attack.t1016","attack.t1482"],"technique_ids":["T1016","T1482"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate administration use but user and host must be investigated"],"references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)","https://thedfirreport.com/2021/08/16/trickbot-leads-up-to-fake-1password-installation/","https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/","https://book.hacktricks.xyz/windows/basic-cmd-for-pentesters","https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/","https://eqllib.readthedocs.io/en/latest/analytics/03e231a6-74bc-467a-acb1-e5676b0fb55e.html","https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/","https://github.com/redcanaryco/atomic-red-team/blob/5360c9d9ffa3b25f6495f7a16e267b719eba2c37/atomics/T1482/T1482.md#atomic-test-2---windows---discover-domain-trusts-with-nltest"],"source_path":"rules/windows/process_creation/proc_creation_win_nltest_recon.yml","source_sha256":"a40330e4f631169523a802f3c943110077553471a6a717d3e2c3263adcd43059","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_nltest_recon.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Recon Activity Via Nltest.EXE\nid: 5cc90652-4cbd-4241-aa3b-4b462fa5a248\nrelated:\n    - id: 410ad193-a728-4107-bc79-4419789fcbf8\n      type: similar\n    - id: 903076ff-f442-475a-b667-4f246bcc203b\n      type: similar\n    - id: 77815820-246c-47b8-9741-e0def3f57308\n      type: obsolete\nstatus: test\ndescription: Detects nltest commands that can be used for information discovery\nreferences:\n    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)\n    - https://thedfirreport.com/2021/08/16/trickbot-leads-up-to-fake-1password-installation/\n    - https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/\n    - https://book.hacktricks.xyz/windows/basic-cmd-for-pentesters\n    - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/\n    - https://eqllib.readthedocs.io/en/latest/analytics/03e231a6-74bc-467a-acb1-e5676b0fb55e.html\n    - https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/\n    - https://github.com/redcanaryco/atomic-red-team/blob/5360c9d9ffa3b25f6495f7a16e267b719eba2c37/atomics/T1482/T1482.md#atomic-test-2---windows---discover-domain-trusts-with-nltest\nauthor: Craig Young, oscd.community, Georg Lauenstein\ndate: 2021-07-24\nmodified: 2023-12-15\ntags:\n    - attack.discovery\n    - attack.t1016\n    - attack.t1482\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_nltest:\n        - Image|endswith: '\\nltest.exe'\n        - OriginalFileName: 'nltestrk.exe'\n    selection_recon:\n        - CommandLine|contains|all:\n              - 'server'\n              - 'query'\n        - CommandLine|contains:\n              - '/user'\n              - 'all_trusts' # Flag for /domain_trusts\n              - 'dclist:'\n              - 'dnsgetdc:'\n              - 'domain_trusts'\n              - 'dsgetdc:'\n              - 'parentdomain'\n              - 'trusted_domains'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate administration use but user and host must be investigated\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1016","id":"T1016","name":"System Network Configuration Discovery","page":"techniques/enterprise/T1016/"},{"key":"enterprise/T1482","id":"T1482","name":"Domain Trust Discovery","page":"techniques/enterprise/T1482/"}],"data_path":"data/detection-rules/5cc90652-4cbd-4241-aa3b-4b462fa5a248.json","kind":"sigma"}