diff --git a/atomics/T1482/T1482.md b/atomics/T1482/T1482.md index 30227654..4fad2de7 100644 --- a/atomics/T1482/T1482.md +++ b/atomics/T1482/T1482.md @@ -72,6 +72,7 @@ This technique has been used by the Trickbot malware family. ```cmd nltest /domain_trusts +nltest /trusted_domains ``` @@ -117,6 +118,7 @@ Get-NetDomainTrust Get-NetForestTrust Get-ADDomain Get-ADGroupMember Administrators -Recursive +([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships() ``` diff --git a/atomics/T1482/T1482.yaml b/atomics/T1482/T1482.yaml index c369728b..6a854918 100644 --- a/atomics/T1482/T1482.yaml +++ b/atomics/T1482/T1482.yaml @@ -30,6 +30,7 @@ atomic_tests: executor: command: | nltest /domain_trusts + nltest /trusted_domains name: command_prompt - name: Powershell enumerate domains and forests auto_generated_guid: c58fbc62-8a62-489e-8f2d-3565d7d96f30 @@ -59,6 +60,7 @@ atomic_tests: Get-NetForestTrust Get-ADDomain Get-ADGroupMember Administrators -Recursive + ([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships() name: powershell - name: Adfind - Enumerate Active Directory OUs auto_generated_guid: d1c73b96-ab87-4031-bad8-0e1b3b8bf3ec