diff --git a/atomics/T1482/T1482.md b/atomics/T1482/T1482.md
index 95400bb9..6dd099c9 100644
--- a/atomics/T1482/T1482.md
+++ b/atomics/T1482/T1482.md
@@ -8,6 +8,8 @@
- [Atomic Test #2 - Windows - Discover domain trusts with nltest](#atomic-test-2---windows---discover-domain-trusts-with-nltest)
+- [Atomic Test #3 - Powershell enumerate domains and forests](#atomic-test-3---powershell-enumerate-domains-and-forests)
+
@@ -43,4 +45,23 @@ nltest /domain_trusts
+
+
+
+## Atomic Test #3 - Powershell enumerate domains and forests
+Use powershell to enumerate AD information
+
+**Supported Platforms:** Windows
+
+
+#### Run it with `powershell`!
+```
+Get-NetDomainTrust
+Get-NetForestTrust
+Get-ADDomain
+Get-ADGroupMember Administrators -Recursive
+```
+
+
+
diff --git a/atomics/index.md b/atomics/index.md
index 31f88412..7aac073b 100644
--- a/atomics/index.md
+++ b/atomics/index.md
@@ -542,6 +542,7 @@
- [T1482 Domain Trust Discovery](./T1482/T1482.md)
- Atomic Test #1: Windows - Discover domain trusts with dsquery [windows]
- Atomic Test #2: Windows - Discover domain trusts with nltest [windows]
+ - Atomic Test #3: Powershell enumerate domains and forests [windows]
- [T1083 File and Directory Discovery](./T1083/T1083.md)
- Atomic Test #1: File and Directory Discovery [windows]
- Atomic Test #2: File and Directory Discovery [windows]
diff --git a/atomics/index.yaml b/atomics/index.yaml
index f64ebd7e..fafb2bdd 100644
--- a/atomics/index.yaml
+++ b/atomics/index.yaml
@@ -15899,6 +15899,20 @@ discovery:
command: 'nltest /domain_trusts
'
+ - name: Powershell enumerate domains and forests
+ description: 'Use powershell to enumerate AD information
+
+'
+ supported_platforms:
+ - windows
+ executor:
+ name: powershell
+ elevation_required: false
+ command: |
+ Get-NetDomainTrust
+ Get-NetForestTrust
+ Get-ADDomain
+ Get-ADGroupMember Administrators -Recursive
T1083:
technique:
x_mitre_permissions_required:
diff --git a/atomics/windows-index.md b/atomics/windows-index.md
index 772bf8de..cd84e413 100644
--- a/atomics/windows-index.md
+++ b/atomics/windows-index.md
@@ -384,6 +384,7 @@
- [T1482 Domain Trust Discovery](./T1482/T1482.md)
- Atomic Test #1: Windows - Discover domain trusts with dsquery [windows]
- Atomic Test #2: Windows - Discover domain trusts with nltest [windows]
+ - Atomic Test #3: Powershell enumerate domains and forests [windows]
- [T1083 File and Directory Discovery](./T1083/T1083.md)
- Atomic Test #1: File and Directory Discovery [windows]
- Atomic Test #2: File and Directory Discovery [windows]