AN0016
Analytic 0016
Windows
Adversary uses nltest, PowerShell, or Win32/.NET API to enumerate domain trust relationships (via DSEnumerateDomainTrusts, GetAllTrustRelationships, or LDAP queries), followed by discovery or authentication staging.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=7
WinEventLog:Sysmon
EventCode=10
WinEventLog:PowerShell
Get-ADTrust|GetAllTrustRelationships
WinEventLog:Security
EventCode=4662
[ParentImage]
Tune based on expected script hosts or authorized administrators invoking trust enumeration.
[TimeWindow]
Correlate enumeration + subsequent Kerberos activity or DC interaction within a bounded window.
[UserContext]
Prioritize detection for non-admin or unexpected user accounts performing enumeration.
[API_Name]
Flag uncommon or low-prevalence API calls like DSEnumerateDomainTrusts for inspection.