{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1482","id":"T1482","name":"Domain Trust Discovery","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1482","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"bb5868e9cc9985655f1d26b0fa15b7a7ec6232d7997b516e33ed34d1d5036508","description":"Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain.(Citation: Microsoft Trusts) Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct [SID-History Injection](https://attack.mitre.org/techniques/T1134/005), [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003), and [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).(Citation: AdSecurity Forging Trust Tickets)(Citation: Harmj0y Domain Trusts) Domain trusts can be enumerated using the `DSEnumerateDomainTrusts()` Win32 API call, .NET methods, and LDAP.(Citation: Harmj0y Domain Trusts) The Windows utility [Nltest](https://attack.mitre.org/software/S0359) is known to be used by adversaries to enumerate domain trusts.(Citation: Microsoft Operation Wilysupply)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1482","external_id":"T1482"},{"source_name":"Microsoft Operation Wilysupply","description":"Florio, E.. (2017, May 4). Windows Defender ATP thwarts Operation WilySupply software supply chain cyberattack. Retrieved February 14, 2019.","url":"https://www.microsoft.com/security/blog/2017/05/04/windows-defender-atp-thwarts-operation-wilysupply-software-supply-chain-cyberattack/"},{"source_name":"AdSecurity Forging Trust Tickets","description":"Metcalf, S. (2015, July 15). It’s All About Trust – Forging Kerberos Trust Tickets to Spoof Access across Active Directory Trusts. Retrieved February 14, 2019.","url":"https://adsecurity.org/?p=1588"},{"source_name":"Microsoft Trusts","description":"Microsoft. (2009, October 7). Trust Technologies. Retrieved February 14, 2019.","url":"https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc759554(v=ws.10)"},{"source_name":"Microsoft GetAllTrustRelationships","description":"Microsoft. (n.d.). Domain.GetAllTrustRelationships Method. Retrieved February 14, 2019.","url":"https://docs.microsoft.com/en-us/dotnet/api/system.directoryservices.activedirectory.domain.getalltrustrelationships?redirectedfrom=MSDN&view=netframework-4.7.2#System_DirectoryServices_ActiveDirectory_Domain_GetAllTrustRelationships"},{"source_name":"Harmj0y Domain Trusts","description":"Schroeder, W. (2017, October 30). A Guide to Attacking Domain Trusts. Retrieved February 14, 2019.","url":"https://posts.specterops.io/a-guide-to-attacking-domain-trusts-971e52cb2944"}],"platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0071","name":"Active Directory Object Access","page":"telemetry/DC0071/","kind":"attack_component","category":"Windows and directory audit","description":"Access to Active Directory objects and properties.","collection_focus":"Enable Audit Directory Service Access and scoped object SACLs; interpret access masks and property GUIDs in their directory context.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"},{"name":"Active Directory domain controllers","scope":"Directory changes and authentication records; collect from the relevant controllers, not only endpoints.","source_id":"ad"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["object_dn","access","actor"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0071","collector":"illustrative-lab-collector","observation":{"object_dn":"CN=LabUser,OU=Lab,DC=example,DC=test","access":"read_property","actor":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0016","name":"Module Load","page":"telemetry/DC0016/","kind":"attack_component","category":"Endpoint activity","description":"A module or library being loaded into a running process.","collection_focus":"Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","image_loaded","signed","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0035","name":"Process Access","page":"telemetry/DC0035/","kind":"attack_component","category":"Endpoint activity","description":"One process opening or accessing another process.","collection_focus":"Scope Sysmon ProcessAccess (10) to the selected source/target processes and access rights; retain call-trace fields where emitted.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["source_process_id","target_process_id","granted_access","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1482","id":"T1482","name":"Domain Trust Discovery","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1482","technique_page":"techniques/enterprise/T1482/","page":"detections/enterprise/T1482/","status":"rule_source_available","counts":{"sigma":17,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[{"id":"31d68132-4038-47c7-8f8e-635a39a7c174","title":"Potential Active Directory Reconnaissance/Enumeration Via LDAP","status":"test","level":"medium","logsource":{"product":"windows","service":"ldap","definition":"Requirements: Microsoft-Windows-LDAP-Client/Debug ETW logging"},"data_path":"data/detection-rules/31d68132-4038-47c7-8f8e-635a39a7c174.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/ldap/win_ldap_recon.yml","author":"Adeem Mawani","kind":"sigma"},{"id":"a21bcd7e-38ec-49ad-b69a-9ea17e69509e","title":"DNS Server Discovery Via LDAP Query","status":"test","level":"low","logsource":{"product":"windows","category":"dns_query"},"data_path":"data/detection-rules/a21bcd7e-38ec-49ad-b69a-9ea17e69509e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/dns_query/dns_query_win_dns_server_discovery_via_ldap_query.yml","author":"frack113","kind":"sigma"},{"id":"02773bed-83bf-469f-b7ff-e676e7d78bab","title":"BloodHound Collection Files","status":"test","level":"high","logsource":{"product":"windows","category":"file_event"},"data_path":"data/detection-rules/02773bed-83bf-469f-b7ff-e676e7d78bab.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_bloodhound_collection.yml","author":"C.J. May","kind":"sigma"},{"id":"0a1255c5-d732-4b62-ac02-b5152d34fb83","title":"ADExplorer Writing Complete AD Snapshot Into .dat File","status":"experimental","level":"medium","logsource":{"category":"file_event","product":"windows"},"data_path":"data/detection-rules/0a1255c5-d732-4b62-ac02-b5152d34fb83.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_sysinternals_adexplorer_dump_written.yml","author":"Arnim Rupp (Nextron Systems), Thomas Patzke","kind":"sigma"},{"id":"7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c","title":"Malicious PowerShell Commandlets - PoshModule","status":"test","level":"high","logsource":{"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"},"data_path":"data/detection-rules/7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_module/posh_pm_malicious_commandlets.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"89819aa4-bbd6-46bc-88ec-c7f7fe30efa6","title":"Malicious PowerShell Commandlets - ScriptBlock","status":"test","level":"high","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/89819aa4-bbd6-46bc-88ec-c7f7fe30efa6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_malicious_commandlets.yml","author":"Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer","kind":"sigma"},{"id":"3bad990e-4848-4a78-9530-b427d854aac0","title":"Domain Trust Discovery Via Dsquery","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/3bad990e-4848-4a78-9530-b427d854aac0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_dsquery_domain_trust_discovery.yml","author":"E.M. Anhaus, Tony Lambert, oscd.community, omkar72","kind":"sigma"},{"id":"f376c8a7-a2d0-4ddc-aa0c-16c17236d962","title":"HackTool - Bloodhound/Sharphound Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f376c8a7-a2d0-4ddc-aa0c-16c17236d962.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_bloodhound_sharphound.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"b2317cfa-4a47-4ead-b3ff-297438c0bc2d","title":"HackTool - SharpView Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b2317cfa-4a47-4ead-b3ff-297438c0bc2d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_sharpview.yml","author":"frack113","kind":"sigma"},{"id":"69ca006d-b9a9-47f5-80ff-ecd4d25d481a","title":"HackTool - TruffleSnout Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/69ca006d-b9a9-47f5-80ff-ecd4d25d481a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_trufflesnout.yml","author":"frack113","kind":"sigma"},{"id":"903076ff-f442-475a-b667-4f246bcc203b","title":"Nltest.EXE Execution","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/903076ff-f442-475a-b667-4f246bcc203b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_nltest_execution.yml","author":"Arun Chauhan","kind":"sigma"},{"id":"5cc90652-4cbd-4241-aa3b-4b462fa5a248","title":"Potential Recon Activity Via Nltest.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/5cc90652-4cbd-4241-aa3b-4b462fa5a248.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_nltest_recon.yml","author":"Craig Young, oscd.community, Georg Lauenstein","kind":"sigma"},{"id":"02030f2f-6199-49ec-b258-ea71b07e03dc","title":"Malicious PowerShell Commandlets - ProcessCreation","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/02030f2f-6199-49ec-b258-ea71b07e03dc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_malicious_cmdlets.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"9a132afa-654e-11eb-ae93-0242ac130002","title":"PUA - AdFind Suspicious Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/9a132afa-654e-11eb-ae93-0242ac130002.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage.yml","author":"Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community","kind":"sigma"},{"id":"df55196f-f105-44d3-a675-e9dfb6cc2f2b","title":"Renamed AdFind Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/df55196f-f105-44d3-a675-e9dfb6cc2f2b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_adfind.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"9212f354-7775-4e28-9c9f-8f0a4544e664","title":"Active Directory Database Snapshot Via ADExplorer","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/9212f354-7775-4e28-9c9f-8f0a4544e664.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sysinternals_adexplorer_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"ef61af62-bc74-4f58-b49b-626448227652","title":"Suspicious Active Directory Database Snapshot Via ADExplorer","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/ef61af62-bc74-4f58-b49b-626448227652.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sysinternals_adexplorer_susp_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0007","name":"Detection of Domain Trust Discovery via API, Script, and CLI Enumeration","url":"https://attack.mitre.org/detectionstrategies/DET0007","stix_id":"x-mitre-detection-strategy--3414f3b8-17a2-438c-8bbc-a261a04da8bc","relationship_id":"relationship--fee2c7b4-9246-4abb-af00-64175d16fc8d","description":"","analytics":[{"id":"AN0016","name":"Analytic 0016","guidance":"Adversary uses nltest, PowerShell, or Win32/.NET API to enumerate domain trust relationships (via DSEnumerateDomainTrusts, GetAllTrustRelationships, or LDAP queries), followed by discovery or authentication staging.","url":"https://attack.mitre.org/detectionstrategies/DET0007#AN0016","platforms":["Windows"],"tuning":[{"field":"ParentImage","description":"Tune based on expected script hosts or authorized administrators invoking trust enumeration."},{"field":"TimeWindow","description":"Correlate enumeration + subsequent Kerberos activity or DC interaction within a bounded window."},{"field":"UserContext","description":"Prioritize detection for non-admin or unexpected user accounts performing enumeration."},{"field":"API_Name","description":"Flag uncommon or low-prevalence API calls like DSEnumerateDomainTrusts for inspection."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0016","source_url":"https://attack.mitre.org/detectionstrategies/DET0007#AN0016","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0016","component":"Module Load","name":"WinEventLog:Sysmon","channel":"EventCode=7","platforms":["Windows"],"analytic_id":"AN0016","source_url":"https://attack.mitre.org/detectionstrategies/DET0007#AN0016","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"},{"component_id":"DC0035","component":"Process Access","name":"WinEventLog:Sysmon","channel":"EventCode=10","platforms":["Windows"],"analytic_id":"AN0016","source_url":"https://attack.mitre.org/detectionstrategies/DET0007#AN0016","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0035/"},{"component_id":"DC0064","component":"Command Execution","name":"WinEventLog:PowerShell","channel":"Get-ADTrust|GetAllTrustRelationships","platforms":["Windows"],"analytic_id":"AN0016","source_url":"https://attack.mitre.org/detectionstrategies/DET0007#AN0016","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0071","component":"Active Directory Object Access","name":"WinEventLog:Security","channel":"EventCode=4662","platforms":["Windows"],"analytic_id":"AN0016","source_url":"https://attack.mitre.org/detectionstrategies/DET0007#AN0016","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0071/"}]}]}],"telemetry_references":[{"id":"DC0071","name":"Active Directory Object Access","tag":"Active Directory Object Access","page":"telemetry/DC0071/","kind":"attack_component"},{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0016","name":"Module Load","tag":"Module Load","page":"telemetry/DC0016/","kind":"attack_component"},{"id":"DC0035","name":"Process Access","tag":"Process Access","page":"telemetry/DC0035/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0552","name":"AdFind","page":"tools/S0552/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0521","name":"BloodHound","page":"tools/S0521/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1063","name":"Brute Ratel C4","page":"tools/S1063/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0105","name":"dsquery","page":"tools/S0105/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0359","name":"Nltest","page":"tools/S0359/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0378","name":"PoshC2","page":"tools/S0378/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0194","name":"PowerSploit","page":"tools/S0194/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1071","name":"Rubeus","page":"tools/S1071/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0552","name":"AdFind","page":"tools/S0552/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0521","name":"BloodHound","page":"tools/S0521/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1063","name":"Brute Ratel C4","page":"tools/S1063/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0105","name":"dsquery","page":"tools/S0105/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0359","name":"Nltest","page":"tools/S0359/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0378","name":"PoshC2","page":"tools/S0378/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0194","name":"PowerSploit","page":"tools/S0194/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1071","name":"Rubeus","page":"tools/S1071/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0105","name":"dsquery","url":"https://attack.mitre.org/software/S0105","kind":"tool","description":"[dsquery](https://attack.mitre.org/software/S0105) can be used to gather information on domain trusts with <code>dsquery * -filter \"(objectClass=trustedDomain)\" -attr *</code>.(Citation: Harmj0y Domain Trusts)","relationship_id":"relationship--da7ddc38-f706-43b4-b3e7-fa3e5d1d2cff","references":[{"source_name":"Harmj0y Domain Trusts","description":"Schroeder, W. (2017, October 30). A Guide to Attacking Domain Trusts. Retrieved February 14, 2019.","url":"https://posts.specterops.io/a-guide-to-attacking-domain-trusts-971e52cb2944"}]},{"id":"S0194","name":"PowerSploit","url":"https://attack.mitre.org/software/S0194","kind":"tool","description":"[PowerSploit](https://attack.mitre.org/software/S0194) has modules such as <code>Get-NetDomainTrust</code> and <code>Get-NetForestTrust</code> to enumerate domain and forest trusts.(Citation: GitHub PowerSploit May 2012)(Citation: PowerSploit Documentation)","relationship_id":"relationship--ee2068ec-c520-476e-979f-3dea201d0b9e","references":[{"source_name":"GitHub PowerSploit May 2012","description":"PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.","url":"https://github.com/PowerShellMafia/PowerSploit"},{"source_name":"PowerSploit Documentation","description":"PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.","url":"http://powersploit.readthedocs.io"}]},{"id":"S0266","name":"TrickBot","url":"https://attack.mitre.org/software/S0266","kind":"malware","description":"[TrickBot](https://attack.mitre.org/software/S0266) can gather information about domain trusts by utilizing [Nltest](https://attack.mitre.org/software/S0359).(Citation: Fortinet TrickBot)(Citation: Cyberreason Anchor December 2019)","relationship_id":"relationship--f4d15148-3a41-4fbc-a42e-59379724acc5","references":[{"source_name":"Fortinet TrickBot","description":"Bacurio Jr., F. and Salvio, J. (2018, April 9). Trickbot’s New Reconnaissance Plugin. Retrieved February 14, 2019.","url":"https://www.fortinet.com/blog/threat-research/trickbot-s-new-reconnaissance-plugin.html"},{"source_name":"Cyberreason Anchor December 2019","description":"Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September 10, 2020.","url":"https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"}]},{"id":"S0359","name":"Nltest","url":"https://attack.mitre.org/software/S0359","kind":"tool","description":"[Nltest](https://attack.mitre.org/software/S0359) may be used to enumerate trusted domains by using commands such as <code>nltest /domain_trusts</code>.(Citation: Nltest Manual)(Citation: Fortinet TrickBot)","relationship_id":"relationship--7f5933ff-6665-4bee-a291-0152c928747d","references":[{"source_name":"Nltest Manual","description":"ss64. (n.d.). NLTEST.exe - Network Location Test. Retrieved February 14, 2019.","url":"https://ss64.com/nt/nltest.html"},{"source_name":"Fortinet TrickBot","description":"Bacurio Jr., F. and Salvio, J. (2018, April 9). Trickbot’s New Reconnaissance Plugin. Retrieved February 14, 2019.","url":"https://www.fortinet.com/blog/threat-research/trickbot-s-new-reconnaissance-plugin.html"}]},{"id":"S0363","name":"Empire","url":"https://attack.mitre.org/software/S0363","kind":"tool","description":"[Empire](https://attack.mitre.org/software/S0363) has modules for enumerating domain trusts.(Citation: Github PowerShell Empire)","relationship_id":"relationship--0cc7cd3a-629e-4f90-9fca-1dde823fa428","references":[{"source_name":"Github PowerShell Empire","description":"Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.","url":"https://github.com/PowerShellEmpire/Empire"}]},{"id":"S0378","name":"PoshC2","url":"https://attack.mitre.org/software/S0378","kind":"tool","description":"[PoshC2](https://attack.mitre.org/software/S0378) has modules for enumerating domain trusts.(Citation: GitHub PoshC2)","relationship_id":"relationship--c8f79da7-cfd6-41fd-89d4-c015e7289b64","references":[{"source_name":"GitHub PoshC2","description":"Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.","url":"https://github.com/nettitude/PoshC2_Python"}]},{"id":"S0483","name":"IcedID","url":"https://attack.mitre.org/software/S0483","kind":"malware","description":"[IcedID](https://attack.mitre.org/software/S0483) used [Nltest](https://attack.mitre.org/software/S0359) during initial discovery.(Citation: DFIR_Sodinokibi_Ransomware)(Citation: DFIR_Quantum_Ransomware)","relationship_id":"relationship--20e08063-e851-4230-a59e-b378ec8676ec","references":[{"source_name":"DFIR_Sodinokibi_Ransomware","description":"DFIR. (2021, March 29). Sodinokibi (aka REvil) Ransomware. Retrieved July 22, 2024.","url":"https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/"},{"source_name":"DFIR_Quantum_Ransomware","description":"DFIR. (2022, April 25). Quantum Ransomware. Retrieved July 26, 2024.","url":"https://thedfirreport.com/2022/04/25/quantum-ransomware/"}]},{"id":"S0521","name":"BloodHound","url":"https://attack.mitre.org/software/S0521","kind":"tool","description":"[BloodHound](https://attack.mitre.org/software/S0521) has the ability to map domain trusts and identify misconfigurations for potential abuse.(Citation: CrowdStrike BloodHound April 2018)","relationship_id":"relationship--a79a17c4-02d1-463f-ac0a-d62b20d10b2f","references":[{"source_name":"CrowdStrike BloodHound April 2018","description":"Red Team Labs. (2018, April 24). Hidden Administrative Accounts: BloodHound to the Rescue. Retrieved October 28, 2020.","url":"https://www.crowdstrike.com/blog/hidden-administrative-accounts-bloodhound-to-the-rescue/"}]},{"id":"S0534","name":"Bazar","url":"https://attack.mitre.org/software/S0534","kind":"malware","description":"[Bazar](https://attack.mitre.org/software/S0534) can use [Nltest](https://attack.mitre.org/software/S0359) tools to obtain information about the domain.(Citation: Cybereason Bazar July 2020)(Citation: NCC Group Team9 June 2020)","relationship_id":"relationship--120f001f-eb9c-4183-89f1-7c6e4bddc80c","references":[{"source_name":"Cybereason Bazar July 2020","description":"Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.","url":"https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"},{"source_name":"NCC Group Team9 June 2020","description":"Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.","url":"https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/"}]},{"id":"S0552","name":"AdFind","url":"https://attack.mitre.org/software/S0552","kind":"tool","description":"[AdFind](https://attack.mitre.org/software/S0552) can gather information about organizational units (OUs) and domain trusts from Active Directory.(Citation: Red Canary Hospital Thwarted Ryuk October 2020)(Citation: FireEye FIN6 Apr 2019)(Citation: FireEye Ryuk and Trickbot January 2019)(Citation: Symantec Bumblebee June 2022)","relationship_id":"relationship--31025044-b0de-4dcd-bd26-fe467b803000","references":[{"source_name":"Red Canary Hospital Thwarted Ryuk October 2020","description":"Brian Donohue, Katie Nickels, Paul Michaud, Adina Bodkins, Taylor Chapman, Tony Lambert, Jeff Felling, Kyle Rainey, Mike Haag, Matt Graeber, Aaron Didier.. (2020, October 29). A Bazar start: How one hospital thwarted a Ryuk ransomware outbreak. Retrieved October 30, 2020.","url":"https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/"},{"source_name":"FireEye Ryuk and Trickbot January 2019","description":"Goody, K., et al (2019, January 11). A Nasty Trick: From Credential Theft Malware to Business Disruption. Retrieved May 12, 2020.","url":"https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html"},{"source_name":"Symantec Bumblebee June 2022","description":"Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime"},{"source_name":"FireEye FIN6 Apr 2019","description":"McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019.","url":"https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"}]},{"id":"S0650","name":"QakBot","url":"https://attack.mitre.org/software/S0650","kind":"malware","description":"[QakBot](https://attack.mitre.org/software/S0650) can run <code>nltest /domain_trusts /all_trusts</code> for domain trust discovery.(Citation: Kaspersky QakBot September 2021)","relationship_id":"relationship--8879fdf1-552c-4e47-a60b-659ebf72772a","references":[{"source_name":"Kaspersky QakBot September 2021","description":"Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021.","url":"https://securelist.com/qakbot-technical-analysis/103931/"}]},{"id":"S1063","name":"Brute Ratel C4","url":"https://attack.mitre.org/software/S1063","kind":"tool","description":"[Brute Ratel C4](https://attack.mitre.org/software/S1063) can use LDAP queries and `nltest /domain_trusts` for domain trust discovery.(Citation: Palo Alto Brute Ratel July 2022)(Citation: Trend Micro Black Basta October 2022)","relationship_id":"relationship--a4e9aaf6-2c02-45cf-9603-090d65cd8c37","references":[{"source_name":"Palo Alto Brute Ratel July 2022","description":"Harbison, M. and Renals, P. (2022, July 5). When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors. Retrieved February 1, 2023.","url":"https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"},{"source_name":"Trend Micro Black Basta October 2022","description":"Kenefick, I. et al. (2022, October 12). Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike. Retrieved February 6, 2023.","url":"https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html"}]},{"id":"S1071","name":"Rubeus","url":"https://attack.mitre.org/software/S1071","kind":"tool","description":"[Rubeus](https://attack.mitre.org/software/S1071) can gather information about domain trusts.(Citation: DFIR Ryuk's Return October 2020)(Citation: DFIR Ryuk 2 Hour Speed Run November 2020)","relationship_id":"relationship--3376df6e-0a4d-4a28-98b9-5d40ef092588","references":[{"source_name":"DFIR Ryuk 2 Hour Speed Run November 2020","description":"The DFIR Report. (2020, November 5). Ryuk Speed Run, 2 Hours to Ransom. Retrieved November 6, 2020.","url":"https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/"},{"source_name":"DFIR Ryuk's Return October 2020","description":"The DFIR Report. (2020, October 8). Ryuk’s Return. Retrieved October 9, 2020.","url":"https://thedfirreport.com/2020/10/08/ryuks-return/"}]},{"id":"S1081","name":"BADHATCH","url":"https://attack.mitre.org/software/S1081","kind":"malware","description":"[BADHATCH](https://attack.mitre.org/software/S1081) can use `nltest.exe /domain_trusts` to discover domain trust relationships on a compromised machine.(Citation: BitDefender BADHATCH Mar 2021)","relationship_id":"relationship--b7b996f4-eb93-457d-a0e7-999e2dd39182","references":[{"source_name":"BitDefender BADHATCH Mar 2021","description":"Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"}]},{"id":"S1124","name":"SocGholish","url":"https://attack.mitre.org/software/S1124","kind":"malware","description":"[SocGholish](https://attack.mitre.org/software/S1124) can profile compromised systems to identify domain trust relationships.(Citation: SocGholish-update)(Citation: Red Canary SocGholish March 2024)","relationship_id":"relationship--499af4be-5b6b-40b2-8df7-f41011ed1f4d","references":[{"source_name":"SocGholish-update","description":"Andrew Northern. (2022, November 22). SocGholish, a very real threat from a very fake update. Retrieved February 13, 2024.","url":"https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"},{"source_name":"Red Canary SocGholish March 2024","description":"Red Canary. (2024, March). Red Canary 2024 Threat Detection Report: SocGholish. Retrieved March 22, 2024.","url":"https://redcanary.com/threat-detection-report/threats/socgholish/"}]},{"id":"S1145","name":"Pikabot","url":"https://attack.mitre.org/software/S1145","kind":"malware","description":"[Pikabot](https://attack.mitre.org/software/S1145) will gather information concerning the Windows Domain the victim machine is a member of during execution.(Citation: Elastic Pikabot 2024)","relationship_id":"relationship--2ba3fc03-9a46-47b9-aeec-1207702ef4cf","references":[{"source_name":"Elastic Pikabot 2024","description":"Daniel Stepanic & Salim Bitam. (2024, February 23). PIKABOT, I choose you!. Retrieved July 12, 2024.","url":"https://www.elastic.co/security-labs/pikabot-i-choose-you"}]},{"id":"S1146","name":"MgBot","url":"https://attack.mitre.org/software/S1146","kind":"malware","description":"[MgBot](https://attack.mitre.org/software/S1146) includes modules for collecting information on local domain users and permissions.(Citation: Symantec Daggerfly 2023)","relationship_id":"relationship--79ad0030-3301-4063-866f-4947531ff8c0","references":[{"source_name":"Symantec Daggerfly 2023","description":"Threat Hunter Team. (2023, April 20). Daggerfly: APT Actor Targets Telecoms Company in Africa. Retrieved July 25, 2024.","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"}]},{"id":"S1159","name":"DUSTTRAP","url":"https://attack.mitre.org/software/S1159","kind":"malware","description":"[DUSTTRAP](https://attack.mitre.org/software/S1159) can identify Active Directory information and related items.(Citation: Google Cloud APT41 2024)","relationship_id":"relationship--c6bdda33-7d5a-4dab-b6aa-464cfd63222a","references":[{"source_name":"Google Cloud APT41 2024","description":"Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}]},{"id":"S1160","name":"Latrodectus","url":"https://attack.mitre.org/software/S1160","kind":"malware","description":"[Latrodectus](https://attack.mitre.org/software/S1160) can run `C:\\Windows\\System32\\cmd.exe /c nltest /domain_trusts` to discover domain trusts.(Citation: Elastic Latrodectus May 2024)(Citation: Bitsight Latrodectus June 2024)","relationship_id":"relationship--a7d74cbe-ff0d-428c-8869-148f6bab807b","references":[{"source_name":"Bitsight Latrodectus June 2024","description":"Batista, J. (2024, June 17). Latrodectus, are you coming back?. Retrieved September 13, 2024.","url":"https://www.bitsight.com/blog/latrodectus-are-you-coming-back"},{"source_name":"Elastic Latrodectus May 2024","description":"Stepanic, D. and Bousseaden, S. (2024, May 15). Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID. Retrieved September 13, 2024.","url":"https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"}]},{"id":"S9035","name":"LAMEHUG","url":"https://attack.mitre.org/software/S9035","kind":"malware","description":"[LAMEHUG](https://attack.mitre.org/software/S9035) can gather Active Directory domain information.(Citation: Nov AI Threat Tracker)","relationship_id":"relationship--63180054-9c6f-4a15-8361-a946d3bb26bb","references":[{"source_name":"Nov AI Threat Tracker","description":"Google Threat Intelligence Group. (2025, November 5). GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools. Retrieved March 31, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools"}]},{"id":"S9051","name":"The Gentlemen Ransomware","url":"https://attack.mitre.org/software/S9051","kind":"malware","description":"[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has gathered Active Directory domain details utilizing the PowerShell cmdlet `Get-ADDomain`.(Citation: TrendAI_TheGentlemen_Sept2025) ","relationship_id":"relationship--8f8a63b4-b80a-4a93-959e-95fb24ef5ebe","references":[{"source_name":"TrendAI_TheGentlemen_Sept2025","description":"Santos, J., et al. (2025, September 9). Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed . Retrieved September 18, 2026.","url":"https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/unmasking-the-gentlemen-ransomware"}]}],"actors":[{"id":"G0030","name":"Lotus Blossom","url":"https://attack.mitre.org/groups/G0030","kind":"intrusion-set","description":"[Lotus Blossom](https://attack.mitre.org/groups/G0030) has used tools such as [AdFind](https://attack.mitre.org/software/S0552) to make Active Directory queries.(Citation: Symantec Bilbug 2022)","relationship_id":"relationship--780e0d90-1fe6-4f93-b507-efc1813e0ccb","references":[{"source_name":"Symantec Bilbug 2022","description":"Symntec Threat Hunter Team. (2022, November 12). Billbug: State-sponsored Actor Targets Cert Authority, Government Agencies in Multiple Asian Countries. Retrieved March 15, 2025.","url":"https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority"}]},{"id":"G0059","name":"Magic Hound","url":"https://attack.mitre.org/groups/G0059","kind":"intrusion-set","description":"[Magic Hound](https://attack.mitre.org/groups/G0059) has used a web shell to execute `nltest /trusted_domains` to identify trust relationships.(Citation: DFIR Phosphorus November 2021)","relationship_id":"relationship--cfbff9fe-2d62-4d80-b7b8-b35e84189803","references":[{"source_name":"DFIR Phosphorus November 2021","description":"DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023.","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"}]},{"id":"G0061","name":"FIN8","url":"https://attack.mitre.org/groups/G0061","kind":"intrusion-set","description":"[FIN8](https://attack.mitre.org/groups/G0061) has retrieved a list of trusted domains by using <code>nltest.exe /domain_trusts</code>.(Citation: Bitdefender FIN8 July 2021)","relationship_id":"relationship--f5f833ab-9ee4-477b-854a-b7b4446761ba","references":[{"source_name":"Bitdefender FIN8 July 2021","description":"Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.","url":"https://businessinsights.bitdefender.com/deep-dive-into-a-fin8-attack-a-forensic-investigation"}]},{"id":"G0114","name":"Chimera","url":"https://attack.mitre.org/groups/G0114","kind":"intrusion-set","description":"[Chimera](https://attack.mitre.org/groups/G0114) has <code>nltest /domain_trusts</code> to identify domain trust relationships.(Citation: NCC Group Chimera January 2021)","relationship_id":"relationship--47d7a2ff-104a-49f9-a28f-6b1a79eca559","references":[{"source_name":"NCC Group Chimera January 2021","description":"Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"id":"G1006","name":"Earth Lusca","url":"https://attack.mitre.org/groups/G1006","kind":"intrusion-set","description":"[Earth Lusca](https://attack.mitre.org/groups/G1006) has used [Nltest](https://attack.mitre.org/software/S0359) to obtain information about domain controllers.(Citation: TrendMicro EarthLusca 2022)","relationship_id":"relationship--a38efb2d-3014-4196-b936-326a9a65ee83","references":[{"source_name":"TrendMicro EarthLusca 2022","description":"Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"id":"G1024","name":"Akira","url":"https://attack.mitre.org/groups/G1024","kind":"intrusion-set","description":"[Akira](https://attack.mitre.org/groups/G1024) uses the built-in [Nltest](https://attack.mitre.org/software/S0359) utility or tools such as [AdFind](https://attack.mitre.org/software/S0552) to enumerate Active Directory trusts in victim environments.(Citation: Arctic Wolf Akira 2023) ","relationship_id":"relationship--35d6d4f5-3c25-47bb-97d9-67d1e004d180","references":[{"source_name":"Arctic Wolf Akira 2023","description":"Steven Campbell, Akshay Suthar, & Connor Belfiorre. (2023, July 26). Conti and Akira: Chained Together. Retrieved February 20, 2024.","url":"https://arcticwolf.com/resources/blog/conti-and-akira-chained-together/"}]},{"id":"G1043","name":"BlackByte","url":"https://attack.mitre.org/groups/G1043","kind":"intrusion-set","description":"[BlackByte](https://attack.mitre.org/groups/G1043) enumerated Active Directory information and trust relationships during operations.(Citation: FBI BlackByte 2022)(Citation: Microsoft BlackByte 2023)","relationship_id":"relationship--1002e4b9-a9c0-403d-ad81-692b34474dc0","references":[{"source_name":"Microsoft BlackByte 2023","description":"Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"},{"source_name":"FBI BlackByte 2022","description":"US Federal Bureau of Investigation & US Secret Service. (2022, February 11). Indicators of Compromise Associated with BlackByte Ransomware. Retrieved December 16, 2024.","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}]},{"id":"G1046","name":"Storm-1811","url":"https://attack.mitre.org/groups/G1046","kind":"intrusion-set","description":"[Storm-1811](https://attack.mitre.org/groups/G1046) has enumerated domain accounts and access during intrusions.(Citation: Microsoft Storm-1811 2024)","relationship_id":"relationship--c99726c4-6778-4586-88a7-4e64917dbf74","references":[{"source_name":"Microsoft Storm-1811 2024","description":"Microsoft Threat Intelligence. (2024, May 15). Threat actors misusing Quick Assist in social engineering attacks leading to ransomware. Retrieved March 14, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/"}]},{"id":"G1053","name":"Storm-0501","url":"https://attack.mitre.org/groups/G1053","kind":"intrusion-set","description":"[Storm-0501](https://attack.mitre.org/groups/G1053) has used Windows native utility [Nltest](https://attack.mitre.org/software/S0359) `nltest.exe` for discovery.(Citation: Microsoft Storm-501 Sabbath Ransomware Embargo September 2024)","relationship_id":"relationship--b8ae763a-289b-4c4c-abd1-fb89eeab30ea","references":[{"source_name":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","description":"Microsoft Threat Intelligence. (2024, September 26). Storm-0501: Ransomware attacks expanding to hybrid cloud environments. Retrieved October 19, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}]},{"id":"G1054","name":"MirrorFace","url":"https://attack.mitre.org/groups/G1054","kind":"intrusion-set","description":"[MirrorFace](https://attack.mitre.org/groups/G1054) has run `nltest.exe  /domain_trusts` on compromised systems to discover domain relationships.(Citation: Trend Micro Earth Kasha NOV 2024)\n","relationship_id":"relationship--513d7cf7-8eb7-49e8-8c74-b164ff404760","references":[{"source_name":"Trend Micro Earth Kasha NOV 2024","description":"Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]}],"mitigations":[{"id":"M1030","name":"Network Segmentation","url":"https://attack.mitre.org/mitigations/M1030","kind":"course-of-action","description":"Employ network segmentation for sensitive domains.(Citation: Harmj0y Domain Trusts).","relationship_id":"relationship--68949ed4-db1b-40bb-b2ca-1a91d2739295","references":[{"source_name":"Harmj0y Domain Trusts","description":"Schroeder, W. (2017, October 30). A Guide to Attacking Domain Trusts. Retrieved February 14, 2019.","url":"https://posts.specterops.io/a-guide-to-attacking-domain-trusts-971e52cb2944"}]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Map the trusts within existing domains/forests and keep trust relationships to a minimum.","relationship_id":"relationship--047e6dc3-d213-4d97-8573-9c8da28a0742","references":[]}],"candidates":[{"id":"15fe436d-e771-4ff3-b655-2dca9ba52834","name":"Adfind - Enumerate Active Directory Trusts","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1482/T1482.yaml","description":"Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Trusts\nreference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html\n","inputs":{"optional_args":{"description":"Allows defining arguments to add to the adfind command to tailor it to the specific needs of the environment. Use \"-arg\" notation to add arguments separated by spaces.","type":"string","default":null}},"dependencies":[{"description":"AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\\..\\ExternalPayloads\\AdFind.exe)\n"}],"source_definition_sha256":"08a48c82d99724e9dd127015eaf94f202e1e07f5b491c53d40a2a0f77d2e5f33"},{"id":"2e22641d-0498-48d2-b9ff-c71e496ccdbe","name":"Windows - Discover domain trusts with nltest","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1482/T1482.yaml","description":"Uses the nltest command to discover domain trusts.\nRequires the installation of nltest via Windows RSAT or the Windows Server AD DS role.\nThis technique has been used by the Trickbot malware family.\n","inputs":{},"dependencies":[{"description":"nltest.exe from RSAT must be present on disk\n"}],"source_definition_sha256":"f2b399c2bd5ad630d3f673af97d8cec7b126159cb923e186fab75f2587c70cac"},{"id":"4700a710-c821-4e17-a3ec-9e4c81d6845f","name":"Windows - Discover domain trusts with dsquery","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1482/T1482.yaml","description":"Uses the dsquery command to discover domain trusts.\nRequires the installation of dsquery via Windows RSAT or the Windows Server AD DS role.\n","inputs":{},"dependencies":[],"source_definition_sha256":"4e0b3601438a4bb6396a9aec1ff02699f527d8b62fb6109ba39e8f76d227a07f"},{"id":"58ed10e8-0738-4651-8408-3a3e9a526279","name":"Get-ForestTrust with PowerView","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1482/T1482.yaml","description":"Utilizing PowerView, run Get-ForestTrust to identify forest trusts. Upon execution, progress and info about forest trusts within the domain being scanned will be displayed.\n","inputs":{},"dependencies":[],"source_definition_sha256":"2cd84ba02beb40980d68b97050dd7a32fa25e67222b12bb18b2d94f3a2831b7d"},{"id":"c58fbc62-8a62-489e-8f2d-3565d7d96f30","name":"Powershell enumerate domains and forests","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":2,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1482/T1482.yaml","description":"Use powershell to enumerate AD information.\nRequires the installation of PowerShell AD admin cmdlets via Windows RSAT or the Windows Server AD DS role.\n","inputs":{},"dependencies":[{"description":"PowerView PowerShell script must exist on disk\n"},{"description":"RSAT PowerShell AD admin cmdlets must be installed\n"}],"source_definition_sha256":"cacc8d1158c23c45079253a544773a00a9df6a7992aa9b9a6aef793b9d13d19c"},{"id":"d1c73b96-ab87-4031-bad8-0e1b3b8bf3ec","name":"Adfind - Enumerate Active Directory OUs","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1482/T1482.yaml","description":"Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory OUs\nreference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html\n","inputs":{"optional_args":{"description":"Allows defining arguments to add to the adfind command to tailor it to the specific needs of the environment. Use \"-arg\" notation to add arguments separated by spaces.","type":"string","default":null}},"dependencies":[{"description":"AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\\..\\ExternalPayloads\\AdFind.exe)\n"}],"source_definition_sha256":"efea5a0bddb6db8c80753ffc025867c00c2f775f9d9091d1f966795d5294bdf0"},{"id":"ea1b4f2d-5b82-4006-b64f-f2845608a3bf","name":"TruffleSnout - Listing AD Infrastructure","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1482/T1482.yaml","description":"Iterative AD discovery toolkit for offensive operators. Situational awareness and targeted low noise enumeration. Preference for OpSec.- https://github.com/dsnezhkov/TruffleSnout\n","inputs":{"trufflesnout_path":{"description":"Path to the TruffleSnout executable","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\TruffleSnout.exe"},"domain":{"description":"Domain name to search on","type":"string","default":"%userdomain%"}},"dependencies":[{"description":"TruffleSnout.exe must exist on disk at specified location (#{trufflesnout_path})\n"}],"source_definition_sha256":"aa68d973b345c27cdbe11bfff45a831667f1a1fdd6f5c210a6565196613d41c8"},{"id":"f974894c-5991-4b19-aaf5-7cc2fe298c5d","name":"Get-DomainTrust with PowerView","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1482/T1482.yaml","description":"Utilizing PowerView, run Get-DomainTrust to identify domain trusts. Upon execution, progress and info about trusts within the domain being scanned will be displayed.\n","inputs":{},"dependencies":[],"source_definition_sha256":"e0b3f8ee1849b209a7cd643cbc1a74ca6ad64dfb2a67e05957fdcd2665e05f90"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1134.005":"/ttp-simulation/techniques/enterprise/T1134.005/","T1550.003":"/ttp-simulation/techniques/enterprise/T1550.003/","T1558.003":"/ttp-simulation/techniques/enterprise/T1558.003/","T1482":"/ttp-simulation/techniques/enterprise/T1482/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1482","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0071","collector":"illustrative-lab-collector","observation":{"object_dn":"CN=LabUser,OU=Lab,DC=example,DC=test","access":"read_property","actor":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}