Detection of Get-ForestTrust PowerShell Reconnaissance

This threat brief focuses on the detection of the Get-ForestTrust PowerShell command, a reconnaissance technique frequently utilized by adversaries to enumerate trust relationships within an Active Directory environment. By identifying the execution of this specific command, security teams can detect attackers attempting to map out the network structure, which is a precursor to lateral movement and privilege escalation efforts. The detection methodology targets command-line executions of PowerShell or Command Prompt containing the string 'get-foresttrust', leveraging EDR telemetry to provide visibility into potential reconnaissance activity. Monitoring for this behavior is critical, as it rarely occurs in standard administrative tasks and often indicates an attacker's effort to understand the organizational structure post-compromise.

Attack Chain

1. Attacker gains initial access to an endpoint within the domain.
2. Attacker performs local enumeration to identify user context and available modules.
3. Attacker imports or executes PowerShell-based reconnaissance modules (e.g., PowerSploit).
4. Attacker executes the Get-ForestTrust command to query Active Directory.
5. The command returns detailed information about forest trusts and domain relationships.
6. Attacker leverages identified trust relationships to plan lateral movement to trusted domains.
7. Attacker proceeds to authenticate to target systems in trusted domains using harvested credentials.

Impact

Successful exploitation of Active Directory trust enumeration allows attackers to map the extent of the forest, identifying paths for privilege escalation and lateral movement. This reconnaissance significantly increases the speed and success of follow-on attacks, potentially leading to unauthorized access to sensitive domains or the entire Active Directory forest, facilitating further data exfiltration or ransomware deployment.

Recommendation

Prioritized actions for detection engineering teams:

• Deploy the Sigma rules below to your SIEM to monitor for 'get-foresttrust' in command-line arguments.
• Enable Sysmon Event ID 1 (Process Creation) or Security Event ID 4688 to capture complete command-line executions.
• Map endpoint process logs to the CIM 'Processes' node to support the detection logic.
• Investigate any hits by reviewing the parent process lineage and user context via the identified drilldown searches.