Elastic low stable eql

Enumerating Domain Trusts via NLTEST.EXE

Identifies the use of nltest.exe for domain trust discovery purposes. Adversaries may use this command-line utility to enumerate domain trusts and gain insight into trust relationships, as well as the state of Domain Controller (DC) replication in a Microsoft Windows NT Domain.

View Source

Detection Logic

process where host.os.type == "windows" and event.type == "start" and
    process.name : "nltest.exe" and process.args : (
        "/DCLIST:*", "/DCNAME:*", "/DSGET*",
        "/LSAQUERYFTI:*", "/PARENTDOMAIN",
        "/DOMAIN_TRUSTS", "/BDC_QUERY:*"
        ) and 
not process.parent.name : "PDQInventoryScanner.exe" and
not (
  user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
  /* Don't apply the user.id exclusion to Sysmon for compatibility */
  not data_stream.dataset : ("windows.sysmon_operational", "windows.sysmon")
)

False Positives

⚠ Domain administrators may use this command-line utility for legitimate information gathering purposes, but it is not common for environments with Windows Server 2012 and newer.

Field Validations

Loading…

Comments (0)

Loading comments...