Skip to content

Domain Trust Discovery

Technique · ATTACK:enterprise:T1482

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1482",
  "title": "Domain Trust Discovery",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1482",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--767dbf9e-df3f-45cb-8998-4903ab5f80c0",
  "external_id": "T1482",
  "domain": "enterprise",
  "created": "2019-02-14T16:15:05.974Z",
  "modified": "2026-05-12T15:12:00.642Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "Microsoft Operation Wilysupply",
      "url": "https://www.microsoft.com/security/blog/2017/05/04/windows-defender-atp-thwarts-operation-wilysupply-software-supply-chain-cyberattack/"
    },
    {
      "source_name": "AdSecurity Forging Trust Tickets",
      "url": "https://adsecurity.org/?p=1588"
    },
    {
      "source_name": "Microsoft Trusts",
      "url": "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc759554(v=ws.10)"
    },
    {
      "source_name": "Microsoft GetAllTrustRelationships",
      "url": "https://docs.microsoft.com/en-us/dotnet/api/system.directoryservices.activedirectory.domain.getalltrustrelationships?redirectedfrom=MSDN&view=netframework-4.7.2#System_DirectoryServices_ActiveDirectory_Domain_GetAllTrustRelationships"
    },
    {
      "source_name": "Harmj0y Domain Trusts",
      "url": "https://posts.specterops.io/a-guide-to-attacking-domain-trusts-971e52cb2944"
    }
  ]
}

Explicit source assertions (36)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--047e6dc3-d213-4d97-8573-9c8da28a0742

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0cc7cd3a-629e-4f90-9fca-1dde823fa428

Github PowerShell Empire

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1002e4b9-a9c0-403d-ad81-692b34474dc0

Microsoft BlackByte 2023 · FBI BlackByte 2022

ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--120f001f-eb9c-4183-89f1-7c6e4bddc80c

Cybereason Bazar July 2020 · NCC Group Team9 June 2020

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20e08063-e851-4230-a59e-b378ec8676ec

DFIR_Sodinokibi_Ransomware · DFIR_Quantum_Ransomware

ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ba3fc03-9a46-47b9-aeec-1207702ef4cf

Elastic Pikabot 2024

ATTACK:enterprise:S0552 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31025044-b0de-4dcd-bd26-fe467b803000

Red Canary Hospital Thwarted Ryuk October 2020 · FireEye Ryuk and Trickbot January 2019 · Symantec Bumblebee June 2022 · FireEye FIN6 Apr 2019

ATTACK:enterprise:S1071 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3376df6e-0a4d-4a28-98b9-5d40ef092588

DFIR Ryuk 2 Hour Speed Run November 2020 · DFIR Ryuk's Return October 2020

ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35d6d4f5-3c25-47bb-97d9-67d1e004d180

Arctic Wolf Akira 2023

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47d7a2ff-104a-49f9-a28f-6b1a79eca559

NCC Group Chimera January 2021

ATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--499af4be-5b6b-40b2-8df7-f41011ed1f4d

SocGholish-update · Red Canary SocGholish March 2024

ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--513d7cf7-8eb7-49e8-8c74-b164ff404760

Trend Micro Earth Kasha NOV 2024

ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63180054-9c6f-4a15-8361-a946d3bb26bb

Nov AI Threat Tracker

ATTACK:enterprise:M1030 → mitigates → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68949ed4-db1b-40bb-b2ca-1a91d2739295

Harmj0y Domain Trusts

ATTACK:enterprise:C0049 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6cc4b0dc-d6ec-4d33-81c2-698d0923c752

CISA Leviathan 2024

ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--780e0d90-1fe6-4f93-b507-efc1813e0ccb

Symantec Bilbug 2022

ATTACK:enterprise:S1146 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79ad0030-3301-4063-866f-4947531ff8c0

Symantec Daggerfly 2023

ATTACK:enterprise:S0359 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7f5933ff-6665-4bee-a291-0152c928747d

Nltest Manual · Fortinet TrickBot

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8879fdf1-552c-4e47-a60b-659ebf72772a

Kaspersky QakBot September 2021

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f8a63b4-b80a-4a93-959e-95fb24ef5ebe

TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a38efb2d-3014-4196-b936-326a9a65ee83

TrendMicro EarthLusca 2022

ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4e9aaf6-2c02-45cf-9603-090d65cd8c37

Palo Alto Brute Ratel July 2022 · Trend Micro Black Basta October 2022

ATTACK:enterprise:S0521 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a79a17c4-02d1-463f-ac0a-d62b20d10b2f

CrowdStrike BloodHound April 2018

ATTACK:enterprise:S1160 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7d74cbe-ff0d-428c-8869-148f6bab807b

Bitsight Latrodectus June 2024 · Elastic Latrodectus May 2024

ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b7b996f4-eb93-457d-a0e7-999e2dd39182

BitDefender BADHATCH Mar 2021

ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b8ae763a-289b-4c4c-abd1-fb89eeab30ea

Microsoft Storm-501 Sabbath Ransomware Embargo September 2024

ATTACK:enterprise:S1159 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6bdda33-7d5a-4dab-b6aa-464cfd63222a

Google Cloud APT41 2024

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8f79da7-cfd6-41fd-89d4-c015e7289b64

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c99726c4-6778-4586-88a7-4e64917dbf74

Microsoft Storm-1811 2024

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf0b7d7d-0770-4b97-86ff-cbb5ec19bb83

Volexity SolarWinds · CrowdStrike StellarParticle January 2022 · Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cfbff9fe-2d62-4d80-b7b8-b35e84189803

DFIR Phosphorus November 2021

ATTACK:enterprise:S0105 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--da7ddc38-f706-43b4-b3e7-fa3e5d1d2cff

Harmj0y Domain Trusts

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee2068ec-c520-476e-979f-3dea201d0b9e

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f4d15148-3a41-4fbc-a42e-59379724acc5

Fortinet TrickBot · Cyberreason Anchor December 2019

ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f5f833ab-9ee4-477b-854a-b7b4446761ba

Bitdefender FIN8 July 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc3d0026-20b2-4d38-b276-64d7290c1994

DFIR Conti Bazar Nov 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.