Forensia CTI Core

About

Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain. Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct SID-History Injection, Pass the Ticket, and Kerberoasting. Domain trusts can be enumerated using the `DSEnumerateDomainTrusts()` Win32 API call, .NET methods, and LDAP. The Windows utility Nltest is known to be used by adversaries to enumerate domain trusts.

Platforms: WindowsMITRE ATT&CK ↗

Used by actors

10 known groups

G0030 Lotus Blossom G0059 Magic Hound G0061 FIN8 G0114 Chimera G1006 Earth Lusca G1024 Akira G1043 BlackByte G1046 Storm-1811 G1053 Storm-0501 G1054 MirrorFace

Software

20 malware/tools implement this

dsqueryPowerSploitTrickBotNltestEmpirePoshC2IcedIDBloodHoundBazarAdFindQakBotBrute Ratel C4RubeusBADHATCHSocGholishPikabotMgBotDUSTTRAPLatrodectusLAMEHUG

Corpus indicators tagged with this technique

378 indicators in the corpus carry T1482.

Indicator	Type	Family	Sev	Src
cve-2025-68670	cve	—	85	2
8819a011ff38b0b0587f0cae0f3572502ec3c82d	hash	ransomware	80	2
7890b116d13a52efe696ce1e2c0ed83029775cf4bea836ce551e71d222ee116f	hash	ransomware	80	2
273962821f14982ead6c10823587fd39e89cf2fc	hash	ransomware	80	2
f1551d3e5d144eef4e70a29dd3dc52fb22459d1f	hash	—	80	2
86edacec5be6df1bb5431e228e688ac3936df5b8	hash	ransomware	80	2
b0e292346b4ab3f83fadd8abcce7cfc5b9d50ef73ad141e8bc4a4689fee13504	hash	ransomware	80	2
b659389cde06f5e01e592dca458fe1be07a302c40dc2a820c7f76d4ee788bad3	hash	ransomware	80	2
54a6743781fd4ceb720331fce92f16186931192d	hash	ransomware	80	2
edbf152ed9ac79e5d9e0111d1071af48	hash	ransomware	80	2
b0cfa2089802634ffb8c77962cdb18317a6332d4	hash	ransomware	80	2
64a0ab00d90682b1807c5d7da1a4ae67cde4c5757fc7d995d8f126f0ec8ae983	hash	ransomware	80	2
43f4ca1c7474c0476a42d937dc4af01c8ccfc20331baa0465ac0f3408f52b2e2	hash	ransomware	80	2
e6bff27adbbcfe6b71ac8fad79b8297f	hash	ransomware	80	2
16afa928cd820a572bd47e798f481c46	hash	ransomware	80	2
f962e15c6efebb3c29fe399bb168066042b616affddd83f72570c979184ec55c	hash	ransomware	80	2
f0b3e112ce4807a28e2b5d66a840ed7f	hash	ransomware	80	2
28a9982cf2b4fc53a1545b6ed0d0c1788ca9369a847750f5652ffa0ca7f7b7d3	hash	ransomware	80	2
2b2e657ae1bc2fdcdfe5201a8e0e5224	hash	ransomware	80	2
8bd16897409ae5d5667c345276d2532f493c0f98	hash	ransomware	80	2
259fd28f9e66159d5a30b86688fec184	hash	ransomware	80	2
42a99a5effdc1d02f6b622537de881e1	hash	ransomware	80	2
3e62797fd746ce9bd5d49cb833b7d9ac62d6b7a2	hash	ransomware	80	2
442af2726e22f512b49f67bcdbf7c0d1e806aa8b	hash	ransomware	80	2
16474e9e4773fbc1e0b48a5025fad31b7f084b1beffb9a42687b4d01979885fe	hash	ransomware	80	2
2528df60e55f210a6396dd7740d76afe30d5e9e8684a5b8a02a63bdcb5041bfc	hash	ransomware	80	2
4e4a3751581252e210f6f45881d778d1f482146f92dc790504bfbcd2bdfa0129	hash	ransomware	80	2
6190923b28679eb8230010aff9b1d1a4184e8697540cc021a5be38126f3f6d99	hash	ransomware	80	2
72bed9b26a7747252156b65d24a9a737d70b9bf6aca069c514c1c7b9e04ef9b6	hash	ransomware	80	2
4482fdd6d9269d3b748233ff4a87e9e2	hash	ransomware	80	2

Showing the top 30 by severity of 378.