DC discovery via chained fallback (nltest, Get-ADDomainController, LOGONSERVER)

Luís Marques@remotecodeexecution

•updated Jul 14, 2026•0•0•1

Detects attempts to discover domain controllers using various fallback techniques including nltest, PowerShell cmdlets (Get-ADDomainController), and querying the LOGONSERVER environment variable. Attackers use these methods to map network infrastructure and identify domain controllers for lateral movement or domain enumeration.