Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1482

Domain Trust Discovery

Windowsnothing on this site yetT1482 on attack.mitre.org

Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain. Domain trusts allow the users of the trusted domain to access resources in the trusting domain.

MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection of Domain Trust Discovery via API, Script, and CLI Enumeration

  • Adversary uses nltest, PowerShell, or Win32/.NET API to enumerate domain trust relationships (via DSEnumerateDomainTrusts, GetAllTrustRelationships, or LDAP queries), followed by discovery or authentication staging.

what reduces it

  • M1030 Network Segmentation. Employ network segmentation for sensitive domains..
  • M1047 Audit. Map the trusts within existing domains/forests and keep trust relationships to a minimum.

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.