Domain Trust Discovery - Active Directory Trust Enumeration

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•6

This rule detects attempts to enumerate Active Directory domain trust relationships using common administrative tools. It identifies the execution of 'nltest.exe' with trust-related arguments ('/domain_trusts', '/trusted_domains', '/all_trusts', '/dclist:') and the usage of PowerShell cmdlets or commands ('Get-ADTrust', 'netdom query trust', or Active Directory domain queries) known for querying domain trust configurations. Adversaries often perform this discovery to map out Windows multi-domain or forest environments to identify lateral movement opportunities.