Domain Trust Discovery
Domain trust discovery learns relationships that permit access across identity domains.
What it means
Domain trust discovery learns relationships that permit access across identity domains. These relationships can reveal routes beyond the first affected domain.
An investigation example
An unfamiliar identity enumerates trust relationships before attempting access in another organizational domain.
Evidence to examine
Review directory queries, trust configuration, caller privileges, and cross-domain authentication or resource access.
A common analytical pitfall
Discovering a trust does not establish that the actor can use it or that the destination was compromised.
Response considerations
Preserve the discovery and access chain and assess effective cross-domain permissions rather than trusting diagrammed relationships alone.
Trust describes a possible relationship, not universal access
Identity domains may have trust relationships that allow authentication across boundaries under defined conditions. Discovering those relationships can help someone understand where an account might be recognized. It does not establish that every account can access every resource in the other domain. Authorization, trust direction, filtering, and resource configuration still matter.
Administrative and inventory tools legitimately examine trust information. Investigators should ask who performed the query, from which system, through which process, and whether that behavior fits the role. A domain administrator's planned assessment differs from an unfamiliar process querying relationships immediately after suspicious execution.
A fictional cross-domain lead
An academy operates separate identity environments for central administration and a training lab. An unusual session queries the relationship between them, then attempts access to a resource outside the lab. Analysts preserve directory and authentication records and compare the attempt with the trust configuration at the relevant time.
The discovery event is a lead about possible intent and knowledge, while the access records address whether a boundary was crossed. Keep those facts separate. A failed access attempt can show attempted use of a path without demonstrating successful lateral movement. Also check whether the queried information was cached or obtained from a central management tool rather than the apparent host alone.
Draw the relationship carefully
Create a fictional diagram with two domains, a directional trust, one user, and two resources. Mark which questions concern authentication recognition and which concern resource permission. Then identify logs that could demonstrate an actual access attempt. Do not test trust boundaries against a real organization without authorization; the paper model is enough to understand why discovering a relationship does not automatically grant access across it.
Directory configuration can evolve, so preserve the trust state relevant to the event where possible. A diagram drawn from today's environment may not represent the boundary that existed during the incident. Record that uncertainty if historical configuration is unavailable.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1482: Domain Trust Discovery