Cascading Domain Controller discovery via nltest, AD module, DNS, and LOGONSERVER

Duo Tech@duotech

•updated Jul 15, 2026•1•0•6

This rule detects discovery of domain controllers in an Active Directory environment. It monitors for the use of 'nltest.exe' with the '/dclist' argument and specific PowerShell cmdlets or methods used to identify domain controllers, such as 'Get-ADDomainController', '[System.Net.Dns]::GetHostEntry', or querying '$env:LOGONSERVER'.