Windows nltest.exe Recon via Server Query and Domain Trust Enumeration
Alerts on nltest.exe commands with server/query and domain trust enumeration arguments often used for Windows discovery.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- Craig Young, oscd.community, Georg Lauenstein (SigmaHQ), DRL 1.1
- Published
- 2021-07-24
- Updated
- 2026-07-30
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions of nltest.exe (including nltestrk.exe) that include command-line patterns consistent with server querying and domain trust enumeration. Such activity can indicate reconnaissance for domain relationships and directory infrastructure prior to further access attempts. The detection relies on Windows process creation telemetry, matching the executable name and specific command-line substrings used by nltest for discovery.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)
- thedfirreport.comhttps://thedfirreport.com/2021/08/16/trickbot-leads-up-to-fake-1password-installation/
- thedfirreport.comhttps://thedfirreport.com/2020/10/18/ryuk-in-5-hours/
- book.hacktricks.xyzhttps://book.hacktricks.xyz/windows/basic-cmd-for-pentesters
- research.nccgroup.comhttps://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
- eqllib.readthedocs.iohttps://eqllib.readthedocs.io/en/latest/analytics/03e231a6-74bc-467a-acb1-e5676b0fb55e.html
- redcanary.comhttps://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/5360c9d9ffa3b25f6495f7a16e267b719eba2c37/atomics/T1482/T1482.md#atomic-test-2---windows---discover-domain-trusts-with-nltest
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_nltest_recon.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-nltest-exe-recon-via-server-query-and-domain-trust-enumeration-5cc90652
title: Windows nltest.exe Recon via Server Query and Domain Trust Enumeration
id: 94609279-60ac-4e80-9838-69a166cc302e
related:
- id: 410ad193-a728-4107-bc79-4419789fcbf8
type: similar
- id: 903076ff-f442-475a-b667-4f246bcc203b
type: similar
- id: 77815820-246c-47b8-9741-e0def3f57308
type: obsolete
- id: 5cc90652-4cbd-4241-aa3b-4b462fa5a248
type: derived
status: test
description: This rule flags process executions of nltest.exe (including nltestrk.exe) that include command-line patterns consistent with server querying and domain trust enumeration. Such activity can indicate reconnaissance for domain relationships and directory infrastructure prior to further access attempts. The detection relies on Windows process creation telemetry, matching the executable name and specific command-line substrings used by nltest for discovery.
references:
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)
- https://thedfirreport.com/2021/08/16/trickbot-leads-up-to-fake-1password-installation/
- https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/
- https://book.hacktricks.xyz/windows/basic-cmd-for-pentesters
- https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
- https://eqllib.readthedocs.io/en/latest/analytics/03e231a6-74bc-467a-acb1-e5676b0fb55e.html
- https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/
- https://github.com/redcanaryco/atomic-red-team/blob/5360c9d9ffa3b25f6495f7a16e267b719eba2c37/atomics/T1482/T1482.md#atomic-test-2---windows---discover-domain-trusts-with-nltest
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_nltest_recon.yml
author: Craig Young, oscd.community, Georg Lauenstein, Huntrule Team
date: 2021-07-24
modified: 2023-12-15
tags:
- attack.discovery
- attack.t1016
- attack.t1482
logsource:
category: process_creation
product: windows
detection:
selection_nltest:
- Image|endswith: \nltest.exe
- OriginalFileName: nltestrk.exe
selection_recon:
- CommandLine|contains|all:
- server
- query
- CommandLine|contains:
- /user
- all_trusts
- "dclist:"
- "dnsgetdc:"
- domain_trusts
- "dsgetdc:"
- parentdomain
- trusted_domains
condition: all of selection_*
falsepositives:
- Legitimate administration use but user and host must be investigated
level: medium
license: DRL-1.1