Post-ClickFix NLTEST Reconnaissance

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•5

Detects the execution of 'nltest.exe' with the '/dclist:' argument, which is used for enumerating domain controllers. This activity is often observed during reconnaissance phases, particularly after initial compromise or execution of specific malware like 'ClickFix'.