Real-world descriptions of how a group, tool or campaign used a technique.
10 examples
| Technique | Used by | Procedure example |
|---|---|---|
| T1482 Domain Trust Discovery |
GroupBlackByte | BlackByte enumerated Active Directory information and trust relationships during operations. |
| T1482 Domain Trust Discovery |
GroupStorm-1811 | Storm-1811 has enumerated domain accounts and access during intrusions. |
| T1482 Domain Trust Discovery |
GroupAkira | Akira uses the built-in Nltest utility or tools such as AdFind to enumerate Active Directory trusts in victim environments. |
| T1482 Domain Trust Discovery |
GroupStorm-0501 | Storm-0501 has used Windows native utility Nltest `nltest.exe` for discovery. |
| T1482 Domain Trust Discovery |
GroupLotus Blossom | Lotus Blossom has used tools such as AdFind to make Active Directory queries. |
| T1482 Domain Trust Discovery |
GroupChimera | Chimera has |
| T1482 Domain Trust Discovery |
GroupMirrorFace | MirrorFace has run `nltest.exe /domain_trusts` on compromised systems to discover domain relationships. |
| T1482 Domain Trust Discovery |
GroupEarth Lusca | Earth Lusca has used Nltest to obtain information about domain controllers. |
| T1482 Domain Trust Discovery |
GroupMagic Hound | Magic Hound has used a web shell to execute `nltest /trusted_domains` to identify trust relationships. |
| T1482 Domain Trust Discovery |
GroupFIN8 | FIN8 has retrieved a list of trusted domains by using |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
