PowerShell Get-ForestTrust Command Execution

This analytic detects the execution of the `Get-ForestTrust` command, often associated with the PowerSploit framework, via PowerShell Script Block Logging (EventCode=4104). This activity is significant because `Get-ForestTrust` is used to enumerate trust relationships within an Active Directory forest. Adversaries commonly perform this discovery technique as a precursor to lateral movement or privilege escalation, aiming to map out the environment for further exploitation and access to sensitive resources. Detecting this command provides visibility into potential reconnaissance efforts by attackers.