Domain Trust Discovery Via Dsquery

Title: Domain Trust Discovery Via Dsquery
Status: test
Description:Detects execution of "dsquery.exe" for domain trust discovery
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1482/T1482.md
  -https://posts.specterops.io/an-introduction-to-manual-active-directory-querying-with-dsquery-and-ldapsearch-84943c13d7eb?gi=41b97a644843
Author: E.M. Anhaus, Tony Lambert, oscd.community, omkar72
Date: 2019-10-24
modified:2023-02-02
Tags:

• -'attack.discovery'
• -'attack.t1482'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\dsquery.exe' OriginalFileName:'dsquery.exe'   selection_cli:
    CommandLine|contains: 'trustedDomain'
  condition:all of selection_*
Falsepositives:
  -Legitimate use of the utilities by legitimate user for legitimate reason
Level: medium