ATT&CK technique

T1482

Domain Trust Discovery

Discovery 39 detections found

Detection rules

Source	Rule	Status	Updated
splunk	Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script	production	2026-10-09
elastic	AdFind Command Activity	production	2026-10-06
splunk	Get-ForestTrust with PowerShell	production	2026-10-02
splunk	Get-DomainTrust with PowerShell	production	2026-10-02
splunk	DSQuery Domain Discovery	production	2026-10-02
splunk	Detect SharpHound Usage	production	2026-10-02
splunk	Detect SharpHound File Modifications	production	2026-10-02
splunk	Detect SharpHound Command-Line Arguments	production	2026-10-02
splunk	NLTest Domain Trust Discovery	production	2026-10-02
elastic	Enumerating Domain Trusts via DSQUERY.EXE	production	2026-09-18
elastic	Suspicious JetBrains TeamCity Child Process	production	2026-09-18
elastic	Potential PowerShell HackTool Script by Function Names	production	2026-09-18
elastic	PowerShell Suspicious Discovery Related Windows API Functions	production	2026-09-18
elastic	Suspicious Access to LDAP Attributes	production	2026-09-18
elastic	Enumerating Domain Trusts via NLTEST.EXE	production	2026-09-18
elastic	Active Directory Discovery using AdExplorer	production	2026-09-18
splunk	Get-DomainTrust with PowerShell Script Block	production	2026-05-13
splunk	Detect AzureHound Command-Line Arguments	production	2026-05-13
splunk	Detect AzureHound File Modifications	production	2026-05-13
splunk	Get-ForestTrust with PowerShell Script Block	production	2026-05-13
splunk	Network Traffic to Active Directory Web Services Protocol	production	2026-05-13
splunk	Windows SOAPHound Binary Execution	production	2026-05-13
sigma	BloodHound Collection Files	test	2026-02-19
sigma	Malicious PowerShell Commandlets - PoshModule	test	2025-12-10
sigma	Malicious PowerShell Commandlets - ProcessCreation	test	2025-12-10
sigma	Malicious PowerShell Commandlets - ScriptBlock	test	2025-12-10
sigma	PUA - AdFind Suspicious Execution	test	2025-10-24
sigma	Suspicious Active Directory Database Snapshot Via ADExplorer	test	2025-07-09
sigma	ADExplorer Writing Complete AD Snapshot Into .dat File	experimental	2025-07-09
sigma	Active Directory Database Snapshot Via ADExplorer	test	2025-07-09
sigma	Potential Active Directory Reconnaissance/Enumeration Via LDAP	test	2025-07-04
sigma	Renamed AdFind Execution	test	2025-02-26
sigma	Potential Recon Activity Via Nltest.EXE	test	2023-12-15
sigma	DNS Server Discovery Via LDAP Query	test	2023-09-18
sigma	HackTool - SharpView Execution	test	2023-02-14
sigma	HackTool - TruffleSnout Execution	test	2023-02-13
sigma	HackTool - Bloodhound/Sharphound Execution	test	2023-02-04
sigma	Nltest.EXE Execution	test	2023-02-03
sigma	Domain Trust Discovery Via Dsquery	test	2023-02-02