Windows nltest.exe Execution for Network Information Discovery

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process creation events where nltest.exe is executed, including the specific Image ending with '\nltest.exe' and the OriginalFileName value 'nltestrk.exe'. Attackers commonly use nltest functionality to enumerate domain and network-related information during discovery. The detection relies on Windows process creation telemetry that includes the executable path/name and the OriginalFileName field.

Reporting behind it

Related detections9 linkedT1018 — drag to rearrange

Suspicious Active Directory Subnet Enumeration via ADFind Subnets Query (via process_creation)

Uncommon Domain Trust Discovery via Nltest (via process_creation)

Suspicious Domain Controller and Trust Enumeration via Nltest

Windows Process Creation: Renamed AdFind.exe Executions

Windows nltest.exe Recon via Server Query and Domain Trust Enumeration

Windows Process Creation: AdFind Executed with Suspicious Recon Flags

Cisco AAA discovery via show/dir commands

Suspicious Domain Controller Enumeration via Nltest by DeadLock Ransomware

Suspicious Codepage Change Followed By Nltest Domain Trust Discovery

Windows nltest.exe Execution for Network Information Discovery

Pivot detection · T1018 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-nltest-exe-execution-for-network-information-discovery-903076ff

title: Windows nltest.exe Execution for Network Information Discovery
id: 89406863-8cf5-422f-bdad-172c404c37f1
related:
  - id: 5cc90652-4cbd-4241-aa3b-4b462fa5a248
    type: similar
  - id: eeb66bbb-3dde-4582-815a-584aee9fe6d1
    type: obsolete
  - id: 903076ff-f442-475a-b667-4f246bcc203b
    type: derived
status: test
description: This rule identifies process creation events where nltest.exe is executed, including the specific Image ending with '\nltest.exe' and the OriginalFileName value 'nltestrk.exe'. Attackers commonly use nltest functionality to enumerate domain and network-related information during discovery. The detection relies on Windows process creation telemetry that includes the executable path/name and the OriginalFileName field.
references:
  - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/nltest.htm
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_nltest_execution.yml
author: Arun Chauhan, Huntrule Team
date: 2023-02-03
tags:
  - attack.discovery
  - attack.t1016
  - attack.t1018
  - attack.t1482
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \nltest.exe
    - OriginalFileName: nltestrk.exe
  condition: selection
falsepositives:
  - Legitimate administration activity
level: low
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL