BloodHound Domain Trust Collection via SMB

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects network traffic indicative of BloodHound's domain trust collection activity over SMB. Specifically, it looks for TCP traffic on port 445 (SMB) directed to the home network, containing the strings "(objectClass=trustedDomain)" and "SYSVOL" (case-insensitive). This combination suggests an attacker is querying Active Directory for trusted domain objects and potentially enumerating the SYSVOL share, which are common steps in BloodHound's reconnaissance phase to map out trust relationships within a domain.