huntrule

Windows nltest.exe Recon via Server Query and Domain Trust Enumeration

Alerts on nltest.exe commands with server/query and domain trust enumeration arguments often used for Windows discovery.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Craig Young, oscd.community, Georg Lauenstein (SigmaHQ), DRL 1.1
Published
2021-07-24
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process executions of nltest.exe (including nltestrk.exe) that include command-line patterns consistent with server querying and domain trust enumeration. Such activity can indicate reconnaissance for domain relationships and directory infrastructure prior to further access attempts. The detection relies on Windows process creation telemetry, matching the executable name and specific command-line substrings used by nltest for discovery.

Reporting behind it

Related detections9 linkedT1016 — drag to rearrange
Windows nltest.exe Execution for Network Information Discovery
Suspicious Codepage Change Followed By Nltest Domain Trust Discovery
Suspicious Domain Trust Discovery Via Nltest
Malicious Winlogon Process Contact to C2 - Blacklotus - Sysmon (via process_creation)
Suspicious Scheduled Task Enumerated (via process_creation)
Suspicious Firewall Configuration Enumerated - PowerShell (via powershell)
Suspicious Discovery Command Spawned by Java Process
Suspicious Active Directory Subnet Enumeration via ADFind Subnets Query (via process_creation)
Suspicious WMIC Execution from Anomalous Parent Process (via process_creation)
Windows nltest.exe Recon via Server Query and Domain Trust Enumeration
Pivot detection · T1016 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.