RedVDS - Domain Trust/AD CS Abuse Post-Login (T1484)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•1•0•7

Detects a RedVDS login followed by commands modifying domain trusts or attempting Active Directory Certificate Services (AD CS) abuse within a 2-hour window. The rule specifically looks for 'Certify.exe' or 'nltest /domain_trusts' commands after a login from a predefined RedVDS IP range.