1200KM / tool
Nltest — Attack Tool
Nltest is a Windows command-line utility used to list domain controllers and enumerate domain trusts.
Tool identity and evidence
Included because the active pinned ATT&CK object has type tool. This is an upstream classification, not an assurance of benignness or a recommendation to run it.
Aliases: Nltest
Existing author guides
No reviewed association in this snapshot.
Primary documentation
No reviewed association in this snapshot.
Connected ecosystem references
Linked tags
Documented actor use
Explicit actor-to-software uses relationships in the pinned ATT&CK source. These links are historical behavior context, not attribution of current events.
- FIN8 · G0061 · Pinned relationship source (relationship--bf26ba18-224d-421f-8fc7-3748dd2fe9bd)
- Wizard Spider · G0102 · Pinned relationship source (relationship--585842e6-fe9a-4508-8e67-c232f8aa5e76)
- Earth Lusca · G1006 · Pinned relationship source (relationship--c336d7c6-0876-445c-8197-924eae28bc16)
- Volt Typhoon · G1017 · Pinned relationship source (relationship--e22619ba-a141-405c-92e2-4f157f953c14)
- INC Ransom · G1032 · Pinned relationship source (relationship--66ba3524-d395-421b-8564-21c9b06ee38c)
- Play · G1040 · Pinned relationship source (relationship--0a952229-6932-4b04-b281-ea83e21f7fb0)
- Storm-0501 · G1053 · Pinned relationship source (relationship--b14bb111-fcab-45fc-87cb-6b4e49270a1a)
- MirrorFace · G1054 · Pinned relationship source (relationship--2737dbc8-1418-42b3-b509-d9f60c15a839)
Technique-specific simulations and detections
Detection links describe the associated behavior, not independently verified tool-specific signatures.
Telemetry context
Derived from the explicitly linked TTPs; not proof of sensor coverage for this tool.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.