Windows Security: Domain Trust Creation (Event ID 4706)

Alerts on Windows Event ID 4706 indicating a new trust was created to a domain.

FreeUnreviewedSigmamediumv1

windows-security-domain-trust-creation-event-id-4706-0255a820

title: "Windows Security: Domain Trust Creation (Event ID 4706)"
id: 59ab96db-932e-4a9a-a20c-d455dd641289
status: stable
description: This rule flags Windows Security auditing events where a new trust relationship is created to a domain (Event ID 4706). Attackers can use newly established trust relationships to broaden access paths, support persistence, or enable privilege escalation across domain boundaries. The detection relies on the presence of Security log Event ID 4706 telemetry.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4706
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_add_domain_trust.yml
author: Thomas Patzke, Huntrule Team
date: 2019-12-03
modified: 2024-01-16
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1098
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4706
  condition: selection
falsepositives:
  - Legitimate extension of domain structure
level: medium
license: DRL-1.1
related:
  - id: 0255a820-e564-4e40-af2b-6ac61160335c
    type: derived

What it detects

This rule flags Windows Security auditing events where a new trust relationship is created to a domain (Event ID 4706). Attackers can use newly established trust relationships to broaden access paths, support persistence, or enable privilege escalation across domain boundaries. The detection relies on the presence of Security log Event ID 4706 telemetry.

Known false positives

Legitimate extension of domain structure

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.