T1482Discovery

Domain Trust Discovery

Map AD trusts and forest relationships.

§ Where this technique fits

T1482 is catalogued under the Discovery tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 3 on average.

Authoritative reference: attack.mitre.org/techniques/T1482/.

§ Dossiers chaining this technique

Cross-trust attack: child → parent forest via SID History
Forge an inter-realm TGT using a child domain's krbtgt and inject Enterprise Admins SID into SID History to traverse a non-quarantined trust.
step 3 / 6

§ What commonly comes next

01
Golden Ticket
T1558.001 · Credential Access
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

Cross-trust attack: child → parent forest via SID History

§ What commonly comes next