Procedure examples

TrickBot can gather information about domain trusts by utilizing Nltest.

Pikabot will gather information concerning the Windows Domain the victim machine is a member of during execution.

DUSTTRAP can identify Active Directory information and related items.

BADHATCH can use `nltest.exe /domain_trusts` to discover domain trust relationships on a compromised machine.

IcedID used Nltest during initial discovery.

SocGholish can profile compromised systems to identify domain trust relationships.

Latrodectus can run `C:\Windows\System32\cmd.exe /c nltest /domain_trusts` to discover domain trusts.

Bazar can use Nltest tools to obtain information about the domain.

MgBot includes modules for collecting information on local domain users and permissions.

LAMEHUG can gather Active Directory domain information.

QakBot can run nltest /domain_trusts /all_trusts for domain trust discovery.

BloodHound has the ability to map domain trusts and identify misconfigurations for potential abuse.

PowerSploit has modules such as Get-NetDomainTrust and Get-NetForestTrust to enumerate domain and forest trusts.

Empire has modules for enumerating domain trusts.

dsquery can be used to gather information on domain trusts with dsquery * -filter "(objectClass=trustedDomain)" -attr *.

PoshC2 has modules for enumerating domain trusts.

Brute Ratel C4 can use LDAP queries and `nltest /domain_trusts` for domain trust discovery.

Nltest may be used to enumerate trusted domains by using commands such as nltest /domain_trusts.

Rubeus can gather information about domain trusts.

AdFind can gather information about organizational units (OUs) and domain trusts from Active Directory.