Windows nltest.exe Recon via Server Query and Domain Trust Enumeration

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1016System Network Configuration Discovery
- T1482Domain Trust Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process executions of nltest.exe (including nltestrk.exe) that include command-line patterns consistent with server querying and domain trust enumeration. Such activity can indicate reconnaissance for domain relationships and directory infrastructure prior to further access attempts. The detection relies on Windows process creation telemetry, matching the executable name and specific command-line substrings used by nltest for discovery.

Reporting behind it

Related detections9 linkedT1016 — drag to rearrange

Windows nltest.exe Execution for Network Information Discovery

Suspicious Codepage Change Followed By Nltest Domain Trust Discovery

Suspicious Domain Trust Discovery Via Nltest

Malicious Winlogon Process Contact to C2 - Blacklotus - Sysmon (via process_creation)

Suspicious Scheduled Task Enumerated (via process_creation)

Suspicious Firewall Configuration Enumerated - PowerShell (via powershell)

Suspicious Discovery Command Spawned by Java Process

Suspicious Active Directory Subnet Enumeration via ADFind Subnets Query (via process_creation)

Suspicious WMIC Execution from Anomalous Parent Process (via process_creation)

Windows nltest.exe Recon via Server Query and Domain Trust Enumeration

Pivot detection · T1016 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-nltest-exe-recon-via-server-query-and-domain-trust-enumeration-5cc90652

title: Windows nltest.exe Recon via Server Query and Domain Trust Enumeration
id: 94609279-60ac-4e80-9838-69a166cc302e
related:
  - id: 410ad193-a728-4107-bc79-4419789fcbf8
    type: similar
  - id: 903076ff-f442-475a-b667-4f246bcc203b
    type: similar
  - id: 77815820-246c-47b8-9741-e0def3f57308
    type: obsolete
  - id: 5cc90652-4cbd-4241-aa3b-4b462fa5a248
    type: derived
status: test
description: This rule flags process executions of nltest.exe (including nltestrk.exe) that include command-line patterns consistent with server querying and domain trust enumeration. Such activity can indicate reconnaissance for domain relationships and directory infrastructure prior to further access attempts. The detection relies on Windows process creation telemetry, matching the executable name and specific command-line substrings used by nltest for discovery.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)
  - https://thedfirreport.com/2021/08/16/trickbot-leads-up-to-fake-1password-installation/
  - https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/
  - https://book.hacktricks.xyz/windows/basic-cmd-for-pentesters
  - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
  - https://eqllib.readthedocs.io/en/latest/analytics/03e231a6-74bc-467a-acb1-e5676b0fb55e.html
  - https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/
  - https://github.com/redcanaryco/atomic-red-team/blob/5360c9d9ffa3b25f6495f7a16e267b719eba2c37/atomics/T1482/T1482.md#atomic-test-2---windows---discover-domain-trusts-with-nltest
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_nltest_recon.yml
author: Craig Young, oscd.community, Georg Lauenstein, Huntrule Team
date: 2021-07-24
modified: 2023-12-15
tags:
  - attack.discovery
  - attack.t1016
  - attack.t1482
logsource:
  category: process_creation
  product: windows
detection:
  selection_nltest:
    - Image|endswith: \nltest.exe
    - OriginalFileName: nltestrk.exe
  selection_recon:
    - CommandLine|contains|all:
        - server
        - query
    - CommandLine|contains:
        - /user
        - all_trusts
        - "dclist:"
        - "dnsgetdc:"
        - domain_trusts
        - "dsgetdc:"
        - parentdomain
        - trusted_domains
  condition: all of selection_*
falsepositives:
  - Legitimate administration use but user and host must be investigated
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL