T1482Discovery
Domain Trust Discovery
Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain. Domain trusts allow the users of the trusted domain to access resources in the…
CVEs2
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.2
Reports0
Detections
17 Sigma rules tagged T1482Domain Trust DiscoveryT148217 general rules
- BloodHound Collection Fileshightest
- HackTool - Bloodhound/Sharphound Executionhightest
- HackTool - SharpView Executionhightest
- HackTool - TruffleSnout Executionhightest
- Malicious PowerShell Commandlets - PoshModulehightest
- Malicious PowerShell Commandlets - ProcessCreationhightest
- Malicious PowerShell Commandlets - ScriptBlockhightest
- PUA - AdFind Suspicious Executionhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Domain Trust Discovery
2 CVEs, by priority. Each link shows its badge.- CVE-2022-41082Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitHigh · 8.0T1078Valid AccountsT1059.001PowerShell+4 moreMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.02%78.6priority
- CVE-2023-22952Multiple SugarCRM Products Remote Code Execution VulnerabilitySugarCRM · Multiple ProductsKEVPublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1078Valid Accounts+7 moreMITRE CTID mapping of the KEV entry · follow-on activity80.1%Top 0.38%69.1priority