MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1482Domain Trust Discovery

Discovery

View on MITRE ATT&CK →

1 Query

Domain Trust Discovery via nltest or dsquery

mediumproductionDefender XDR

Microsoft Defender for Endpoint·DeviceProcessEvents

DeviceProcessEvents
| where Timestamp > ago(1d)
| where (FileName =~ "nltest.exe" and ProcessCommandLine has_any ("/domain_trusts", "/dclist", "/dsgetdc"))
    or (FileName =~ "dsquery.exe" and ProcessCommandLine has "trustedDomain")
    or (ProcessCommandLine has "Get-ADTrust")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc

FalconForce Team (adapted) · last tested 2025-03-01

attack.mitre.org
github.com

Tuning notes

AD administrators run nltest for troubleshooting. Correlate with the account context — standard user accounts running nltest are suspicious.

+ Add another query for this technique →