Windows nltest.exe Recon via Server Query and Domain Trust Enumeration

Alerts on nltest.exe commands with server/query and domain trust enumeration arguments often used for Windows discovery.

FreeUnreviewedSigmamediumv1

windows-nltest-exe-recon-via-server-query-and-domain-trust-enumeration-5cc90652

title: Windows nltest.exe Recon via Server Query and Domain Trust Enumeration
id: 94609279-60ac-4e80-9838-69a166cc302e
related:
  - id: 410ad193-a728-4107-bc79-4419789fcbf8
    type: similar
  - id: 903076ff-f442-475a-b667-4f246bcc203b
    type: similar
  - id: 77815820-246c-47b8-9741-e0def3f57308
    type: obsolete
  - id: 5cc90652-4cbd-4241-aa3b-4b462fa5a248
    type: derived
status: test
description: This rule flags process executions of nltest.exe (including nltestrk.exe) that include command-line patterns consistent with server querying and domain trust enumeration. Such activity can indicate reconnaissance for domain relationships and directory infrastructure prior to further access attempts. The detection relies on Windows process creation telemetry, matching the executable name and specific command-line substrings used by nltest for discovery.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)
  - https://thedfirreport.com/2021/08/16/trickbot-leads-up-to-fake-1password-installation/
  - https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/
  - https://book.hacktricks.xyz/windows/basic-cmd-for-pentesters
  - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
  - https://eqllib.readthedocs.io/en/latest/analytics/03e231a6-74bc-467a-acb1-e5676b0fb55e.html
  - https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/
  - https://github.com/redcanaryco/atomic-red-team/blob/5360c9d9ffa3b25f6495f7a16e267b719eba2c37/atomics/T1482/T1482.md#atomic-test-2---windows---discover-domain-trusts-with-nltest
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_nltest_recon.yml
author: Craig Young, oscd.community, Georg Lauenstein, Huntrule Team
date: 2021-07-24
modified: 2023-12-15
tags:
  - attack.discovery
  - attack.t1016
  - attack.t1482
logsource:
  category: process_creation
  product: windows
detection:
  selection_nltest:
    - Image|endswith: \nltest.exe
    - OriginalFileName: nltestrk.exe
  selection_recon:
    - CommandLine|contains|all:
        - server
        - query
    - CommandLine|contains:
        - /user
        - all_trusts
        - "dclist:"
        - "dnsgetdc:"
        - domain_trusts
        - "dsgetdc:"
        - parentdomain
        - trusted_domains
  condition: all of selection_*
falsepositives:
  - Legitimate administration use but user and host must be investigated
level: medium
license: DRL-1.1

What it detects

This rule flags process executions of nltest.exe (including nltestrk.exe) that include command-line patterns consistent with server querying and domain trust enumeration. Such activity can indicate reconnaissance for domain relationships and directory infrastructure prior to further access attempts. The detection relies on Windows process creation telemetry, matching the executable name and specific command-line substrings used by nltest for discovery.

Known false positives

Legitimate administration use but user and host must be investigated

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.