New Domain Trust Relationship Created

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•21

This rule detects the creation of a new trust relationship to a domain, indicated by Windows Event ID 4706. The addition of domain trusts is an infrequent administrative action and should be carefully verified for legitimacy, as unauthorized trust relationships could be used for privilege escalation or persistence within an Active Directory environment.