Domain Trust Discovery

Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain.¹ Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct SID-History Injection, Pass the Ticket, and Kerberoasting.²³ Domain trusts can be enumerated using the `DSEnumerateDomainTrusts()` Win32 API call, .NET methods, and LDAP.⁴ The Windows utility Nltest is known to be used by adversaries to enumerate domain trusts.⁵

1. Microsoft Trusts
2. AdSecurity Forging Trust Tickets
3. Harmj0y Domain Trusts
4. Harmj0y Domain Trusts
5. Microsoft Operation Wilysupply

使用该技术的组织

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。