MITRE ATT&CK technique

T1482

Domain Trust Discovery

About this technique

Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain.(Citation: Microsoft Trusts) Domain trusts allow the users of the trusted domain to access resources in the trusting domain.

Read the full ATT&CK description

The information discovered may help the adversary conduct SID-History Injection, Pass the Ticket, and Kerberoasting.(Citation: AdSecurity Forging Trust Tickets)(Citation: Harmj0y Domain Trusts) Domain trusts can be enumerated using the `DSEnumerateDomainTrusts()` Win32 API call, .NET methods, and LDAP.(Citation: Harmj0y Domain Trusts) The Windows utility Nltest is known to be used by adversaries to enumerate domain trusts.(Citation: Microsoft Operation Wilysupply)

TA0007
Curated mapping

Curated incident relationships

These associations come from maintained incident records. The recorded confidence is shown when the source record provides it.

0 items
No curated incident mappings yet.
Heuristic association

Daily items linked through predicted CVEs

A Daily item appears here when it mentions a CVE whose triage artifact predicts this technique. This is not a verified ATT&CK mapping.

0 items
No heuristic Daily associations yet.
Heuristic association

Predicted CVE associations

These backfilled or model-produced candidates come from the current triage artifact. They are informational, not official MITRE mappings.

0 items
No predicted associations yet for this technique.
T1482 · Domain Trust Discovery · Baitaphish