title: Trickbot Malware Recon Activity
id: 410ad193-a728-4107-bc79-4419789fcbf8
status: test
description: Trickbot enumerates domain/network topology and executes certain commands automatically every few minutes. This detectors attempts to identify that activity based off a command rarely observed in an enterprise network.
author: David Burkett, Florian Roth
references:
  - https://www.sneakymonkey.net/2019/05/22/trickbot-analysis/
  - https://app.any.run/tasks/f74c5157-8508-4ac6-9805-d63fe7b0d399/
date: 2019/12/28
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\cmd.exe'
    Image|endswith:
      - '\nltest.exe'
    CommandLine|contains:
      - '/domain_trusts /all_trusts'
  condition: selection
falsepositives:
  - Rare System Admin Activity
level: critical
tags:
  - attack.discovery
  - attack.t1482
