Detection of Domain Trust Discovery via NLTest

Adversaries often use built-in Windows administrative utilities to perform reconnaissance on compromised hosts. The nltest.exe utility is frequently abused to query domain trust relationships, providing attackers with critical information about network architecture, domain hierarchies, and potential paths for lateral movement. By executing nltest.exe with the /domain_trusts or /all_trusts arguments, actors can map the trust topography of an Active Directory environment. This behavior is highly indicative of post-exploitation activity, as legitimate administrative use of these specific flags is rare. This TTP is commonly associated with various ransomware and trojan operations, including Qakbot, Ryuk, IcedID, and Medusa, which utilize the gathered information to identify high-value targets and pivoting opportunities within the victim network.

Impact

Successful domain trust discovery provides adversaries with the necessary intelligence to escalate privileges, conduct cross-domain authentication attacks, and propagate ransomware or malware across an entire enterprise. This reconnaissance step is a critical precursor to wide-scale network compromise and data exfiltration.

Recommendation

Detection engineering teams should implement monitoring for process execution of nltest.exe with suspicious arguments.

• Deploy the provided Sigma rule to monitor for domain trust discovery attempts.
• Enable Sysmon or Windows Security event logging (Event ID 4688) to capture detailed command-line arguments.
• Establish an alert baseline for nltest.exe usage to distinguish between authorized administrative troubleshooting and anomalous reconnaissance.
• Investigate any hits against this rule to confirm if the activity aligns with known attacker infrastructure or unauthorized account behavior.