Register to stream ATT&CKcon 2.0 October 29-30

Nltest

Nltest is a Windows command-line utility used to list domain controllers and enumerate domain trusts.[1]

ID: S0359
Type: TOOL
Platforms: Windows
Version: 1.0

Techniques Used

Domain ID Name Use
Enterprise T1482 Domain Trust Discovery Nltest may be used to enumerate trusted domains by using commands such as nltest /domain_trusts. [1] [2]
Enterprise T1018 Remote System Discovery Nltest may be used to enumerate remote domain controllers using options such as /dclist and /dsgetdc. [1]
Enterprise T1016 System Network Configuration Discovery Nltest may be used to enumerate the parent domain of a local machine using /parentdomain. [1]

References