[New Rule] Domain Trust Enumeration via Nltest #2010

terrancedejesus · 2022-06-01T14:29:13Z

Issues

[New Rule] Enumerating domain trusts activity #437

Summary

This rule detects the use of command-line utility nltest.exe as a child process of cmd.exe where arguments provided suggest domain trust enumeration. This technique has been observed in a Ryuk ransomware investigation as referenced below.

domain_trusts argument

{
  "_index": ".ds-logs-endpoint.events.process-default-2022.06.01-000001",
  "_id": "VgF6H4EB-snQZBCYzPHi",
  "_score": 1,
  "_source": {
    "agent": {
      "id": "0a828983-141f-4be6-8c23-fb1bd6a7e6f3",
      "type": "endpoint",
      "version": "8.2.2"
    },
    "process": {
      "Ext": {
        "ancestry": [
          "MGE4Mjg5ODMtMTQxZi00YmU2LThjMjMtZmIxYmQ2YTdlNmYzLTM3MDAtMTMyOTg1NjM3NDcuMjc4ODQ5NzAw",
          "MGE4Mjg5ODMtMTQxZi00YmU2LThjMjMtZmIxYmQ2YTdlNmYzLTg0NDQtMTMyOTg1MDcyNDMuODYwMDU2NjAw"
        ],
        "code_signature": [
          {
            "trusted": true,
            "subject_name": "Microsoft Windows",
            "exists": true,
            "status": "trusted"
          }
        ]
      },
      "parent": {
        "args": [
          "C:\\Windows\\system32\\cmd.exe"
        ],
        "name": "cmd.exe",
        "pid": 3700,
        "args_count": 1,
        "entity_id": "MGE4Mjg5ODMtMTQxZi00YmU2LThjMjMtZmIxYmQ2YTdlNmYzLTM3MDAtMTMyOTg1NjM3NDcuMjc4ODQ5NzAw",
        "command_line": "\"C:\\Windows\\system32\\cmd.exe\" ",
        "executable": "C:\\Windows\\System32\\cmd.exe"
      },
      "pid": 11108,
      "entity_id": "MGE4Mjg5ODMtMTQxZi00YmU2LThjMjMtZmIxYmQ2YTdlNmYzLTExMTA4LTEzMjk4NTY0MTQ0Ljc4OTYxNjQwMA==",
      "executable": "C:\\Windows\\System32\\nltest.exe",
      "args": [
        "nltest.exe",
        "/domain_trusts"
      ],
      "code_signature": {
        "trusted": true,
        "subject_name": "Microsoft Windows",
        "exists": true,
        "status": "trusted"
      },
      "pe": {
        "original_file_name": "nltestrk.exe"
      },
      "exit_code": 1,
      "name": "nltest.exe",
      "args_count": 2,
      "command_line": "nltest.exe  /domain_trusts",
      "hash": {
        "sha1": "d568f62430417bdfa888949a0fb725eae0870ea6",
        "sha256": "553bbf90f51033e76b1f721ed60ef583766d22f2cef4baae473d6876902de0b3",
        "md5": "9be98cfde66da15f7c94c7f332dc8ef3"
      }
    },
    "message": "Endpoint process event",
    "@timestamp": "2022-06-01T13:35:45.0140443Z",
    "ecs": {
      "version": "1.11.0"
    },
    "data_stream": {
      "namespace": "default",
      "type": "logs",
      "dataset": "endpoint.events.process"
    },
    "elastic": {
      "agent": {
        "id": "0a828983-141f-4be6-8c23-fb1bd6a7e6f3"
      }
    },
    "host": {
      "hostname": "winserver-tdejesus",
      "os": {
        "Ext": {
          "variant": "Windows Server 2022 Datacenter"
        },
        "kernel": "21H2 (10.0.20348.707)",
        "name": "Windows",
        "family": "windows",
        "type": "windows",
        "version": "21H2 (10.0.20348.707)",
        "platform": "windows",
        "full": "Windows Server 2022 Datacenter 21H2 (10.0.20348.707)"
      },
      "ip": [
        "10.142.15.199",
        "fe80::d9c3:7a18:96d6:35c",
        "127.0.0.1",
        "::1"
      ],
      "name": "winserver-tdejesus",
      "id": "04d7c4e9-48f6-4bc8-8914-d87ec67eedd3",
      "mac": [
        "42:01:0a:8e:0f:c7"
      ],
      "architecture": "x86_64"
    },
    "event": {
      "agent_id_status": "verified",
      "sequence": 918,
      "ingested": "2022-06-01T13:35:50Z",
      "created": "2022-06-01T13:35:45.0140443Z",
      "kind": "event",
      "module": "endpoint",
      "action": "end",
      "id": "MdRedBvE5OU4cHRf++++++RX",
      "category": [
        "process"
      ],
      "type": [
        "end"
      ],
      "dataset": "endpoint.events.process"
    },
    "user": {
      "domain": "WINSERVER-TDEJE",
      "name": "terrance_dejesus",
      "id": "S-1-5-21-3883428562-1491877956-3560675551-1000"
    }
  },
  "fields": {
    "process.hash.md5": [
      "9be98cfde66da15f7c94c7f332dc8ef3"
    ],
    "host.os.full.text": [
      "Windows Server 2022 Datacenter 21H2 (10.0.20348.707)"
    ],
    "process.command_line.caseless": [
      "nltest.exe  /domain_trusts"
    ],
    "event.category": [
      "process"
    ],
    "process.name.text": [
      "nltest.exe"
    ],
    "host.os.name.text": [
      "Windows"
    ],
    "host.os.full": [
      "Windows Server 2022 Datacenter 21H2 (10.0.20348.707)"
    ],
    "process.parent.command_line": [
      "\"C:\\Windows\\system32\\cmd.exe\" "
    ],
    "process.parent.name": [
      "cmd.exe"
    ],
    "process.parent.pid": [
      3700
    ],
    "process.hash.sha256": [
      "553bbf90f51033e76b1f721ed60ef583766d22f2cef4baae473d6876902de0b3"
    ],
    "host.hostname": [
      "winserver-tdejesus"
    ],
    "process.pid": [
      11108
    ],
    "process.code_signature.exists": [
      true
    ],
    "host.mac": [
      "42:01:0a:8e:0f:c7"
    ],
    "elastic.agent.id": [
      "0a828983-141f-4be6-8c23-fb1bd6a7e6f3"
    ],
    "process.code_signature.subject_name": [
      "Microsoft Windows"
    ],
    "process.parent.entity_id": [
      "MGE4Mjg5ODMtMTQxZi00YmU2LThjMjMtZmIxYmQ2YTdlNmYzLTM3MDAtMTMyOTg1NjM3NDcuMjc4ODQ5NzAw"
    ],
    "host.os.version": [
      "21H2 (10.0.20348.707)"
    ],
    "host.os.name": [
      "Windows"
    ],
    "host.name": [
      "winserver-tdejesus"
    ],
    "event.agent_id_status": [
      "verified"
    ],
    "event.kind": [
      "event"
    ],
    "process.code_signature.trusted": [
      true
    ],
    "user.id": [
      "S-1-5-21-3883428562-1491877956-3560675551-1000"
    ],
    "host.os.type": [
      "windows"
    ],
    "process.Ext.ancestry": [
      "MGE4Mjg5ODMtMTQxZi00YmU2LThjMjMtZmIxYmQ2YTdlNmYzLTM3MDAtMTMyOTg1NjM3NDcuMjc4ODQ5NzAw",
      "MGE4Mjg5ODMtMTQxZi00YmU2LThjMjMtZmIxYmQ2YTdlNmYzLTg0NDQtMTMyOTg1MDcyNDMuODYwMDU2NjAw"
    ],
    "data_stream.type": [
      "logs"
    ],
    "process.parent.args_count": [
      1
    ],
    "host.architecture": [
      "x86_64"
    ],
    "process.name": [
      "nltest.exe"
    ],
    "agent.id": [
      "0a828983-141f-4be6-8c23-fb1bd6a7e6f3"
    ],
    "process.parent.executable.text": [
      "C:\\Windows\\System32\\cmd.exe"
    ],
    "ecs.version": [
      "1.11.0"
    ],
    "event.created": [
      "2022-06-01T13:35:45.014Z"
    ],
    "agent.version": [
      "8.2.2"
    ],
    "host.os.family": [
      "windows"
    ],
    "process.command_line.text": [
      "nltest.exe  /domain_trusts"
    ],
    "user.name": [
      "terrance_dejesus"
    ],
    "process.entity_id": [
      "MGE4Mjg5ODMtMTQxZi00YmU2LThjMjMtZmIxYmQ2YTdlNmYzLTExMTA4LTEzMjk4NTY0MTQ0Ljc4OTYxNjQwMA=="
    ],
    "process.parent.name.text": [
      "cmd.exe"
    ],
    "host.ip": [
      "10.142.15.199",
      "fe80::d9c3:7a18:96d6:35c",
      "127.0.0.1",
      "::1"
    ],
    "event.sequence": [
      918
    ],
    "process.executable.caseless": [
      "c:\\windows\\system32\\nltest.exe"
    ],
    "agent.type": [
      "endpoint"
    ],
    "process.pe.original_file_name": [
      "nltestrk.exe"
    ],
    "process.executable.text": [
      "C:\\Windows\\System32\\nltest.exe"
    ],
    "event.module": [
      "endpoint"
    ],
    "host.os.kernel": [
      "21H2 (10.0.20348.707)"
    ],
    "host.os.full.caseless": [
      "windows server 2022 datacenter 21h2 (10.0.20348.707)"
    ],
    "user.domain": [
      "WINSERVER-TDEJE"
    ],
    "process.name.caseless": [
      "nltest.exe"
    ],
    "host.id": [
      "04d7c4e9-48f6-4bc8-8914-d87ec67eedd3"
    ],
    "process.exit_code": [
      1
    ],
    "process.executable": [
      "C:\\Windows\\System32\\nltest.exe"
    ],
    "process.parent.name.caseless": [
      "cmd.exe"
    ],
    "process.parent.executable.caseless": [
      "c:\\windows\\system32\\cmd.exe"
    ],
    "process.parent.executable": [
      "C:\\Windows\\System32\\cmd.exe"
    ],
    "process.parent.command_line.text": [
      "\"C:\\Windows\\system32\\cmd.exe\" "
    ],
    "process.args_count": [
      2
    ],
    "data_stream.namespace": [
      "default"
    ],
    "process.args": [
      "nltest.exe",
      "/domain_trusts"
    ],
    "process.code_signature.status": [
      "trusted"
    ],
    "message": [
      "Endpoint process event"
    ],
    "host.os.Ext.variant": [
      "Windows Server 2022 Datacenter"
    ],
    "process.parent.args": [
      "C:\\Windows\\system32\\cmd.exe"
    ],
    "event.ingested": [
      "2022-06-01T13:35:50Z"
    ],
    "event.action": [
      "end"
    ],
    "@timestamp": [
      "2022-06-01T13:35:45.014Z"
    ],
    "host.os.platform": [
      "windows"
    ],
    "process.parent.command_line.caseless": [
      "\"c:\\windows\\system32\\cmd.exe\" "
    ],
    "data_stream.dataset": [
      "endpoint.events.process"
    ],
    "event.type": [
      "end"
    ],
    "process.Ext.code_signature": [
      {
        "subject_name": [
          "Microsoft Windows"
        ],
        "exists": [
          true
        ],
        "trusted": [
          true
        ],
        "status": [
          "trusted"
        ]
      }
    ],
    "process.command_line": [
      "nltest.exe  /domain_trusts"
    ],
    "process.hash.sha1": [
      "d568f62430417bdfa888949a0fb725eae0870ea6"
    ],
    "event.id": [
      "MdRedBvE5OU4cHRf++++++RX"
    ],
    "host.os.name.caseless": [
      "windows"
    ],
    "event.dataset": [
      "endpoint.events.process"
    ],
    "user.name.text": [
      "terrance_dejesus"
    ]
  }
}

parentdomain argument

{
  "_index": ".ds-logs-endpoint.events.process-default-2022.06.01-000001",
  "_id": "BpOOH4EB_FHuRo8UE71K",
  "_score": 1,
  "_source": {
    "agent": {
      "id": "0a828983-141f-4be6-8c23-fb1bd6a7e6f3",
      "type": "endpoint",
      "version": "8.2.2"
    },
    "process": {
      "Ext": {
        "ancestry": [
          "MGE4Mjg5ODMtMTQxZi00YmU2LThjMjMtZmIxYmQ2YTdlNmYzLTM3MDAtMTMyOTg1NjM3NDcuMjc4ODQ5NzAw",
          "MGE4Mjg5ODMtMTQxZi00YmU2LThjMjMtZmIxYmQ2YTdlNmYzLTg0NDQtMTMyOTg1MDcyNDMuODYwMDU2NjAw"
        ],
        "code_signature": [
          {
            "trusted": true,
            "subject_name": "Microsoft Windows",
            "exists": true,
            "status": "trusted"
          }
        ],
        "authentication_id": "0x1d0f41",
        "token": {
          "integrity_level_name": "high",
          "security_attributes": [
            "TSA://ProcUnique"
          ],
          "elevation_level": "full"
        }
      },
      "args": [
        "nltest.exe",
        "/parentdomain"
      ],
      "parent": {
        "args": [
          "C:\\Windows\\system32\\cmd.exe"
        ],
        "name": "cmd.exe",
        "pid": 3700,
        "args_count": 1,
        "entity_id": "MGE4Mjg5ODMtMTQxZi00YmU2LThjMjMtZmIxYmQ2YTdlNmYzLTM3MDAtMTMyOTg1NjM3NDcuMjc4ODQ5NzAw",
        "command_line": "\"C:\\Windows\\system32\\cmd.exe\" ",
        "executable": "C:\\Windows\\System32\\cmd.exe"
      },
      "code_signature": {
        "trusted": true,
        "subject_name": "Microsoft Windows",
        "exists": true,
        "status": "trusted"
      },
      "pe": {
        "original_file_name": "nltestrk.exe"
      },
      "name": "nltest.exe",
      "pid": 8492,
      "args_count": 2,
      "entity_id": "MGE4Mjg5ODMtMTQxZi00YmU2LThjMjMtZmIxYmQ2YTdlNmYzLTg0OTItMTMyOTg1NjUzODEuOTA3MTM4ODAw",
      "command_line": "nltest.exe  /parentdomain",
      "executable": "C:\\Windows\\System32\\nltest.exe",
      "hash": {
        "sha1": "d568f62430417bdfa888949a0fb725eae0870ea6",
        "sha256": "553bbf90f51033e76b1f721ed60ef583766d22f2cef4baae473d6876902de0b3",
        "md5": "9be98cfde66da15f7c94c7f332dc8ef3"
      }
    },
    "message": "Endpoint process event",
    "@timestamp": "2022-06-01T13:56:21.9071388Z",
    "ecs": {
      "version": "1.11.0"
    },
    "data_stream": {
      "namespace": "default",
      "type": "logs",
      "dataset": "endpoint.events.process"
    },
    "elastic": {
      "agent": {
        "id": "0a828983-141f-4be6-8c23-fb1bd6a7e6f3"
      }
    },
    "host": {
      "hostname": "winserver-tdejesus",
      "os": {
        "Ext": {
          "variant": "Windows Server 2022 Datacenter"
        },
        "kernel": "21H2 (10.0.20348.707)",
        "name": "Windows",
        "family": "windows",
        "type": "windows",
        "version": "21H2 (10.0.20348.707)",
        "platform": "windows",
        "full": "Windows Server 2022 Datacenter 21H2 (10.0.20348.707)"
      },
      "ip": [
        "10.142.15.199",
        "fe80::d9c3:7a18:96d6:35c",
        "127.0.0.1",
        "::1"
      ],
      "name": "winserver-tdejesus",
      "id": "04d7c4e9-48f6-4bc8-8914-d87ec67eedd3",
      "mac": [
        "42:01:0a:8e:0f:c7"
      ],
      "architecture": "x86_64"
    },
    "event": {
      "agent_id_status": "verified",
      "sequence": 6273,
      "ingested": "2022-06-01T13:56:53Z",
      "created": "2022-06-01T13:56:21.9071388Z",
      "kind": "event",
      "module": "endpoint",
      "action": "start",
      "id": "MdRedBvE5OU4cHRf+++++5Ga",
      "category": [
        "process"
      ],
      "type": [
        "start"
      ],
      "dataset": "endpoint.events.process"
    },
    "user": {
      "domain": "WINSERVER-TDEJE",
      "name": "terrance_dejesus",
      "id": "S-1-5-21-3883428562-1491877956-3560675551-1000"
    }
  },
  "fields": {
    "process.hash.md5": [
      "9be98cfde66da15f7c94c7f332dc8ef3"
    ],
    "host.os.full.text": [
      "Windows Server 2022 Datacenter 21H2 (10.0.20348.707)"
    ],
    "process.command_line.caseless": [
      "nltest.exe  /parentdomain"
    ],
    "event.category": [
      "process"
    ],
    "host.os.name.text": [
      "Windows"
    ],
    "process.parent.command_line": [
      "\"C:\\Windows\\system32\\cmd.exe\" "
    ],
    "process.parent.name": [
      "cmd.exe"
    ],
    "process.parent.pid": [
      3700
    ],
    "process.hash.sha256": [
      "553bbf90f51033e76b1f721ed60ef583766d22f2cef4baae473d6876902de0b3"
    ],
    "host.hostname": [
      "winserver-tdejesus"
    ],
    "process.code_signature.exists": [
      true
    ],
    "host.mac": [
      "42:01:0a:8e:0f:c7"
    ],
    "elastic.agent.id": [
      "0a828983-141f-4be6-8c23-fb1bd6a7e6f3"
    ],
    "host.os.version": [
      "21H2 (10.0.20348.707)"
    ],
    "event.agent_id_status": [
      "verified"
    ],
    "user.id": [
      "S-1-5-21-3883428562-1491877956-3560675551-1000"
    ],
    "host.os.type": [
      "windows"
    ],
    "process.Ext.ancestry": [
      "MGE4Mjg5ODMtMTQxZi00YmU2LThjMjMtZmIxYmQ2YTdlNmYzLTM3MDAtMTMyOTg1NjM3NDcuMjc4ODQ5NzAw",
      "MGE4Mjg5ODMtMTQxZi00YmU2LThjMjMtZmIxYmQ2YTdlNmYzLTg0NDQtMTMyOTg1MDcyNDMuODYwMDU2NjAw"
    ],
    "host.architecture": [
      "x86_64"
    ],
    "agent.id": [
      "0a828983-141f-4be6-8c23-fb1bd6a7e6f3"
    ],
    "process.command_line.text": [
      "nltest.exe  /parentdomain"
    ],
    "user.name": [
      "terrance_dejesus"
    ],
    "process.entity_id": [
      "MGE4Mjg5ODMtMTQxZi00YmU2LThjMjMtZmIxYmQ2YTdlNmYzLTg0OTItMTMyOTg1NjUzODEuOTA3MTM4ODAw"
    ],
    "host.ip": [
      "10.142.15.199",
      "fe80::d9c3:7a18:96d6:35c",
      "127.0.0.1",
      "::1"
    ],
    "process.executable.caseless": [
      "c:\\windows\\system32\\nltest.exe"
    ],
    "agent.type": [
      "endpoint"
    ],
    "process.pe.original_file_name": [
      "nltestrk.exe"
    ],
    "process.executable.text": [
      "C:\\Windows\\System32\\nltest.exe"
    ],
    "user.domain": [
      "WINSERVER-TDEJE"
    ],
    "process.name.caseless": [
      "nltest.exe"
    ],
    "host.id": [
      "04d7c4e9-48f6-4bc8-8914-d87ec67eedd3"
    ],
    "process.Ext.token.integrity_level_name": [
      "high"
    ],
    "process.parent.name.caseless": [
      "cmd.exe"
    ],
    "process.code_signature.status": [
      "trusted"
    ],
    "host.os.Ext.variant": [
      "Windows Server 2022 Datacenter"
    ],
    "event.ingested": [
      "2022-06-01T13:56:53Z"
    ],
    "event.action": [
      "start"
    ],
    "@timestamp": [
      "2022-06-01T13:56:21.907Z"
    ],
    "host.os.platform": [
      "windows"
    ],
    "process.parent.command_line.caseless": [
      "\"c:\\windows\\system32\\cmd.exe\" "
    ],
    "data_stream.dataset": [
      "endpoint.events.process"
    ],
    "process.Ext.code_signature": [
      {
        "subject_name": [
          "Microsoft Windows"
        ],
        "exists": [
          true
        ],
        "trusted": [
          true
        ],
        "status": [
          "trusted"
        ]
      }
    ],
    "process.hash.sha1": [
      "d568f62430417bdfa888949a0fb725eae0870ea6"
    ],
    "event.id": [
      "MdRedBvE5OU4cHRf+++++5Ga"
    ],
    "host.os.name.caseless": [
      "windows"
    ],
    "user.name.text": [
      "terrance_dejesus"
    ],
    "process.name.text": [
      "nltest.exe"
    ],
    "host.os.full": [
      "Windows Server 2022 Datacenter 21H2 (10.0.20348.707)"
    ],
    "process.pid": [
      8492
    ],
    "process.code_signature.subject_name": [
      "Microsoft Windows"
    ],
    "process.parent.entity_id": [
      "MGE4Mjg5ODMtMTQxZi00YmU2LThjMjMtZmIxYmQ2YTdlNmYzLTM3MDAtMTMyOTg1NjM3NDcuMjc4ODQ5NzAw"
    ],
    "host.os.name": [
      "Windows"
    ],
    "host.name": [
      "winserver-tdejesus"
    ],
    "event.kind": [
      "event"
    ],
    "process.code_signature.trusted": [
      true
    ],
    "data_stream.type": [
      "logs"
    ],
    "process.parent.args_count": [
      1
    ],
    "process.name": [
      "nltest.exe"
    ],
    "process.Ext.token.security_attributes": [
      "TSA://ProcUnique"
    ],
    "process.parent.executable.text": [
      "C:\\Windows\\System32\\cmd.exe"
    ],
    "ecs.version": [
      "1.11.0"
    ],
    "event.created": [
      "2022-06-01T13:56:21.907Z"
    ],
    "agent.version": [
      "8.2.2"
    ],
    "host.os.family": [
      "windows"
    ],
    "process.parent.name.text": [
      "cmd.exe"
    ],
    "event.sequence": [
      6273
    ],
    "event.module": [
      "endpoint"
    ],
    "host.os.kernel": [
      "21H2 (10.0.20348.707)"
    ],
    "host.os.full.caseless": [
      "windows server 2022 datacenter 21h2 (10.0.20348.707)"
    ],
    "process.executable": [
      "C:\\Windows\\System32\\nltest.exe"
    ],
    "process.parent.executable.caseless": [
      "c:\\windows\\system32\\cmd.exe"
    ],
    "process.parent.executable": [
      "C:\\Windows\\System32\\cmd.exe"
    ],
    "process.parent.command_line.text": [
      "\"C:\\Windows\\system32\\cmd.exe\" "
    ],
    "process.args_count": [
      2
    ],
    "data_stream.namespace": [
      "default"
    ],
    "process.args": [
      "nltest.exe",
      "/parentdomain"
    ],
    "message": [
      "Endpoint process event"
    ],
    "process.Ext.authentication_id": [
      "0x1d0f41"
    ],
    "process.Ext.token.elevation_level": [
      "full"
    ],
    "process.parent.args": [
      "C:\\Windows\\system32\\cmd.exe"
    ],
    "event.type": [
      "start"
    ],
    "process.command_line": [
      "nltest.exe  /parentdomain"
    ],
    "event.dataset": [
      "endpoint.events.process"
    ]
  }
}

dcname:DCNAME argument

{
  "_index": ".ds-logs-endpoint.events.process-default-2022.06.01-000001",
  "_id": "_ZOOH4EB_FHuRo8UhL2Y",
  "_score": 1,
  "_source": {
    "agent": {
      "id": "0a828983-141f-4be6-8c23-fb1bd6a7e6f3",
      "type": "endpoint",
      "version": "8.2.2"
    },
    "process": {
      "Ext": {
        "ancestry": [
          "MGE4Mjg5ODMtMTQxZi00YmU2LThjMjMtZmIxYmQ2YTdlNmYzLTM3MDAtMTMyOTg1NjM3NDcuMjc4ODQ5NzAw",
          "MGE4Mjg5ODMtMTQxZi00YmU2LThjMjMtZmIxYmQ2YTdlNmYzLTg0NDQtMTMyOTg1MDcyNDMuODYwMDU2NjAw"
        ],
        "code_signature": [
          {
            "trusted": true,
            "subject_name": "Microsoft Windows",
            "exists": true,
            "status": "trusted"
          }
        ]
      },
      "parent": {
        "args": [
          "C:\\Windows\\system32\\cmd.exe"
        ],
        "name": "cmd.exe",
        "pid": 3700,
        "args_count": 1,
        "entity_id": "MGE4Mjg5ODMtMTQxZi00YmU2LThjMjMtZmIxYmQ2YTdlNmYzLTM3MDAtMTMyOTg1NjM3NDcuMjc4ODQ5NzAw",
        "command_line": "\"C:\\Windows\\system32\\cmd.exe\" ",
        "executable": "C:\\Windows\\System32\\cmd.exe"
      },
      "pid": 5964,
      "entity_id": "MGE4Mjg5ODMtMTQxZi00YmU2LThjMjMtZmIxYmQ2YTdlNmYzLTU5NjQtMTMyOTg1NjU0MTYuNzMxODYzNjAw",
      "executable": "C:\\Windows\\System32\\nltest.exe",
      "args": [
        "nltest.exe",
        "/dcname:test"
      ],
      "code_signature": {
        "trusted": true,
        "subject_name": "Microsoft Windows",
        "exists": true,
        "status": "trusted"
      },
      "pe": {
        "original_file_name": "nltestrk.exe"
      },
      "exit_code": 1,
      "name": "nltest.exe",
      "args_count": 2,
      "command_line": "nltest.exe  /dcname:test",
      "hash": {
        "sha1": "d568f62430417bdfa888949a0fb725eae0870ea6",
        "sha256": "553bbf90f51033e76b1f721ed60ef583766d22f2cef4baae473d6876902de0b3",
        "md5": "9be98cfde66da15f7c94c7f332dc8ef3"
      }
    },
    "message": "Endpoint process event",
    "@timestamp": "2022-06-01T13:56:59.1234492Z",
    "ecs": {
      "version": "1.11.0"
    },
    "data_stream": {
      "namespace": "default",
      "type": "logs",
      "dataset": "endpoint.events.process"
    },
    "elastic": {
      "agent": {
        "id": "0a828983-141f-4be6-8c23-fb1bd6a7e6f3"
      }
    },
    "host": {
      "hostname": "winserver-tdejesus",
      "os": {
        "Ext": {
          "variant": "Windows Server 2022 Datacenter"
        },
        "kernel": "21H2 (10.0.20348.707)",
        "name": "Windows",
        "family": "windows",
        "type": "windows",
        "version": "21H2 (10.0.20348.707)",
        "platform": "windows",
        "full": "Windows Server 2022 Datacenter 21H2 (10.0.20348.707)"
      },
      "ip": [
        "10.142.15.199",
        "fe80::d9c3:7a18:96d6:35c",
        "127.0.0.1",
        "::1"
      ],
      "name": "winserver-tdejesus",
      "id": "04d7c4e9-48f6-4bc8-8914-d87ec67eedd3",
      "mac": [
        "42:01:0a:8e:0f:c7"
      ],
      "architecture": "x86_64"
    },
    "event": {
      "agent_id_status": "verified",
      "sequence": 6448,
      "ingested": "2022-06-01T13:57:22Z",
      "created": "2022-06-01T13:56:59.1234492Z",
      "kind": "event",
      "module": "endpoint",
      "action": "end",
      "id": "MdRedBvE5OU4cHRf+++++5WA",
      "category": [
        "process"
      ],
      "type": [
        "end"
      ],
      "dataset": "endpoint.events.process"
    },
    "user": {
      "domain": "WINSERVER-TDEJE",
      "name": "terrance_dejesus",
      "id": "S-1-5-21-3883428562-1491877956-3560675551-1000"
    }
  },
  "fields": {
    "process.hash.md5": [
      "9be98cfde66da15f7c94c7f332dc8ef3"
    ],
    "host.os.full.text": [
      "Windows Server 2022 Datacenter 21H2 (10.0.20348.707)"
    ],
    "process.command_line.caseless": [
      "nltest.exe  /dcname:test"
    ],
    "event.category": [
      "process"
    ],
    "process.name.text": [
      "nltest.exe"
    ],
    "host.os.name.text": [
      "Windows"
    ],
    "host.os.full": [
      "Windows Server 2022 Datacenter 21H2 (10.0.20348.707)"
    ],
    "process.parent.command_line": [
      "\"C:\\Windows\\system32\\cmd.exe\" "
    ],
    "process.parent.name": [
      "cmd.exe"
    ],
    "process.parent.pid": [
      3700
    ],
    "process.hash.sha256": [
      "553bbf90f51033e76b1f721ed60ef583766d22f2cef4baae473d6876902de0b3"
    ],
    "host.hostname": [
      "winserver-tdejesus"
    ],
    "process.pid": [
      5964
    ],
    "process.code_signature.exists": [
      true
    ],
    "host.mac": [
      "42:01:0a:8e:0f:c7"
    ],
    "elastic.agent.id": [
      "0a828983-141f-4be6-8c23-fb1bd6a7e6f3"
    ],
    "process.code_signature.subject_name": [
      "Microsoft Windows"
    ],
    "process.parent.entity_id": [
      "MGE4Mjg5ODMtMTQxZi00YmU2LThjMjMtZmIxYmQ2YTdlNmYzLTM3MDAtMTMyOTg1NjM3NDcuMjc4ODQ5NzAw"
    ],
    "host.os.version": [
      "21H2 (10.0.20348.707)"
    ],
    "host.os.name": [
      "Windows"
    ],
    "host.name": [
      "winserver-tdejesus"
    ],
    "event.agent_id_status": [
      "verified"
    ],
    "event.kind": [
      "event"
    ],
    "process.code_signature.trusted": [
      true
    ],
    "user.id": [
      "S-1-5-21-3883428562-1491877956-3560675551-1000"
    ],
    "host.os.type": [
      "windows"
    ],
    "process.Ext.ancestry": [
      "MGE4Mjg5ODMtMTQxZi00YmU2LThjMjMtZmIxYmQ2YTdlNmYzLTM3MDAtMTMyOTg1NjM3NDcuMjc4ODQ5NzAw",
      "MGE4Mjg5ODMtMTQxZi00YmU2LThjMjMtZmIxYmQ2YTdlNmYzLTg0NDQtMTMyOTg1MDcyNDMuODYwMDU2NjAw"
    ],
    "data_stream.type": [
      "logs"
    ],
    "process.parent.args_count": [
      1
    ],
    "host.architecture": [
      "x86_64"
    ],
    "process.name": [
      "nltest.exe"
    ],
    "agent.id": [
      "0a828983-141f-4be6-8c23-fb1bd6a7e6f3"
    ],
    "process.parent.executable.text": [
      "C:\\Windows\\System32\\cmd.exe"
    ],
    "ecs.version": [
      "1.11.0"
    ],
    "event.created": [
      "2022-06-01T13:56:59.123Z"
    ],
    "agent.version": [
      "8.2.2"
    ],
    "host.os.family": [
      "windows"
    ],
    "process.command_line.text": [
      "nltest.exe  /dcname:test"
    ],
    "user.name": [
      "terrance_dejesus"
    ],
    "process.entity_id": [
      "MGE4Mjg5ODMtMTQxZi00YmU2LThjMjMtZmIxYmQ2YTdlNmYzLTU5NjQtMTMyOTg1NjU0MTYuNzMxODYzNjAw"
    ],
    "process.parent.name.text": [
      "cmd.exe"
    ],
    "host.ip": [
      "10.142.15.199",
      "fe80::d9c3:7a18:96d6:35c",
      "127.0.0.1",
      "::1"
    ],
    "event.sequence": [
      6448
    ],
    "process.executable.caseless": [
      "c:\\windows\\system32\\nltest.exe"
    ],
    "agent.type": [
      "endpoint"
    ],
    "process.pe.original_file_name": [
      "nltestrk.exe"
    ],
    "process.executable.text": [
      "C:\\Windows\\System32\\nltest.exe"
    ],
    "event.module": [
      "endpoint"
    ],
    "host.os.kernel": [
      "21H2 (10.0.20348.707)"
    ],
    "host.os.full.caseless": [
      "windows server 2022 datacenter 21h2 (10.0.20348.707)"
    ],
    "user.domain": [
      "WINSERVER-TDEJE"
    ],
    "process.name.caseless": [
      "nltest.exe"
    ],
    "host.id": [
      "04d7c4e9-48f6-4bc8-8914-d87ec67eedd3"
    ],
    "process.exit_code": [
      1
    ],
    "process.executable": [
      "C:\\Windows\\System32\\nltest.exe"
    ],
    "process.parent.name.caseless": [
      "cmd.exe"
    ],
    "process.parent.executable.caseless": [
      "c:\\windows\\system32\\cmd.exe"
    ],
    "process.parent.executable": [
      "C:\\Windows\\System32\\cmd.exe"
    ],
    "process.parent.command_line.text": [
      "\"C:\\Windows\\system32\\cmd.exe\" "
    ],
    "process.args_count": [
      2
    ],
    "data_stream.namespace": [
      "default"
    ],
    "process.args": [
      "nltest.exe",
      "/dcname:test"
    ],
    "process.code_signature.status": [
      "trusted"
    ],
    "message": [
      "Endpoint process event"
    ],
    "host.os.Ext.variant": [
      "Windows Server 2022 Datacenter"
    ],
    "process.parent.args": [
      "C:\\Windows\\system32\\cmd.exe"
    ],
    "event.ingested": [
      "2022-06-01T13:57:22Z"
    ],
    "event.action": [
      "end"
    ],
    "@timestamp": [
      "2022-06-01T13:56:59.123Z"
    ],
    "host.os.platform": [
      "windows"
    ],
    "process.parent.command_line.caseless": [
      "\"c:\\windows\\system32\\cmd.exe\" "
    ],
    "data_stream.dataset": [
      "endpoint.events.process"
    ],
    "event.type": [
      "end"
    ],
    "process.Ext.code_signature": [
      {
        "trusted": [
          true
        ],
        "subject_name": [
          "Microsoft Windows"
        ],
        "exists": [
          true
        ],
        "status": [
          "trusted"
        ]
      }
    ],
    "process.command_line": [
      "nltest.exe  /dcname:test"
    ],
    "process.hash.sha1": [
      "d568f62430417bdfa888949a0fb725eae0870ea6"
    ],
    "event.id": [
      "MdRedBvE5OU4cHRf+++++5WA"
    ],
    "host.os.name.caseless": [
      "windows"
    ],
    "event.dataset": [
      "endpoint.events.process"
    ],
    "user.name.text": [
      "terrance_dejesus"
    ]
  }
}

References

https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)

Contributor checklist

Have you signed the contributor license agreement?
Have you followed the contributor guidelines?

rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml

w0rk3r

LGTM

rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml

Mikaayenson

LGTM

Co-authored-by: Jonhnathan <[email protected]>

rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml

* adding detection rule * removed changes from unrelated rule * adjusted threat technique * Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml * Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml Co-authored-by: Jonhnathan <[email protected]> * Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml Co-authored-by: Jonhnathan <[email protected]> * Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml Co-authored-by: Jonhnathan <[email protected]> Co-authored-by: Justin Ibarra <[email protected]> (cherry picked from commit 329530c)

adding detection rule

784db6c

terrancedejesus added Rule: New Proposal for new rule OS: Windows windows related rules v8.4.0 labels Jun 1, 2022

terrancedejesus linked an issue Jun 1, 2022 that may be closed by this pull request

[New Rule] Enumerating domain trusts activity #437

Closed

removed changes from unrelated rule

cfe04b3

terrancedejesus self-assigned this Jun 1, 2022

terrancedejesus requested review from Samirbous, w0rk3r and DefSecSentinel June 1, 2022 15:24

Merge branch 'main' into 437-new-rule-enumerating-domain-trusts-activity

e0bc082

terrancedejesus marked this pull request as ready for review June 1, 2022 15:25

adjusted threat technique

5a07f69

botelastic bot added the Domain: Endpoint label Jun 1, 2022

github-actions bot added the backport: auto label Jun 1, 2022

Merge branch 'main' into 437-new-rule-enumerating-domain-trusts-activity

aaba4f0

brokensound77 reviewed Jun 8, 2022

View reviewed changes

rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml Outdated Show resolved Hide resolved

terrancedejesus commented Jun 14, 2022

View reviewed changes

rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml Outdated Show resolved Hide resolved

Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml

61f8225

terrancedejesus requested a review from brokensound77 June 14, 2022 14:07

terrancedejesus added 2 commits June 14, 2022 10:07

Merge branch 'main' into 437-new-rule-enumerating-domain-trusts-activity

30915a1

Merge branch 'main' into 437-new-rule-enumerating-domain-trusts-activity

6d25c0d

Mikaayenson reviewed Jun 17, 2022

View reviewed changes

rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml Show resolved Hide resolved

w0rk3r approved these changes Jun 20, 2022

View reviewed changes

Merge branch 'main' into 437-new-rule-enumerating-domain-trusts-activity

34b2ad4

Samirbous approved these changes Jun 24, 2022

View reviewed changes

Mikaayenson self-requested a review June 24, 2022 21:01

Merge branch 'main' into 437-new-rule-enumerating-domain-trusts-activity

73f6753

Mikaayenson approved these changes Jul 1, 2022

View reviewed changes

Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml

263c06f

Co-authored-by: Jonhnathan <[email protected]>

terrancedejesus and others added 2 commits July 5, 2022 09:56

Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml

6be0ba7

Co-authored-by: Jonhnathan <[email protected]>

Merge branch 'main' into 437-new-rule-enumerating-domain-trusts-activity

b111603

terrancedejesus commented Jul 5, 2022

View reviewed changes

rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml Outdated Show resolved Hide resolved

Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml

cea370b

terrancedejesus merged commit 329530c into main Jul 5, 2022

terrancedejesus deleted the 437-new-rule-enumerating-domain-trusts-activity branch July 5, 2022 14:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[New Rule] Domain Trust Enumeration via Nltest #2010

[New Rule] Domain Trust Enumeration via Nltest #2010

Uh oh!

terrancedejesus commented Jun 1, 2022 •

edited by Mikaayenson

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

w0rk3r left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Mikaayenson left a comment

Uh oh!

Uh oh!

Uh oh!

[New Rule] Domain Trust Enumeration via Nltest #2010

[New Rule] Domain Trust Enumeration via Nltest #2010

Uh oh!

Conversation

terrancedejesus commented Jun 1, 2022 • edited by Mikaayenson Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issues

Summary

References

Contributor checklist

Uh oh!

Uh oh!

Uh oh!

Uh oh!

w0rk3r left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Mikaayenson left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

terrancedejesus commented Jun 1, 2022 •

edited by Mikaayenson

Loading