ADTRUST-001: Trust Relationships Enumeration
- Platform
- Active Directory
- Category
- AD Trust Relationships
- Severity
- Info
- Zero Trust pillar
- Identity (weight 1)
- Golden fixtures
- 2
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
For each trust on every reachable domain, the check reads the trustedDomain object from CN=System,DC=domain,DC=tld and extracts the following attributes: - name / trustPartner (the target domain DNS name) - trustDirection (1 = Inbound, 2 = Outbound, 3 = Bidirectional) - trustType (1 = Downlevel/NT, 2 = Uplevel/AD, 3 = MIT/Kerberos realm, 4 = DCE) - trustAttributes (bitmask: NON_TRANSITIVE 0x1, UPLEVEL_ONLY 0x2, QUARANTINED_DOMAIN 0x4, FOREST_TRANSITIVE 0x8, CROSS_ORGANIZATION 0x10, WITHIN_FOREST 0x20, TREAT_AS_EXTERNAL 0x40, USES_RC4_ENCRYPTION 0x80, TRUST_USES_AES_KEYS 0x100, CROSS_ORGANIZATION_NO_TGT_DELEGATION 0x200, PIM_TRUST 0x400, CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION 0x800) - securityIdentifier (the trusted domain SID, required to evaluate SID history risk) - whenCreated / whenChanged (age and last modification of the trust object) - msDS-TrustForestTrustInfo (for forest trusts, the list of namespaces, top-level names, and excluded names) The check uses Get-ADTrust -Filter * against each domain in the forest, falling back to LDAP queries against (objectClass=trustedDomain) when the AD module is not available. It also queries netdom trust /domain:<domain> /verify where possible to confirm the trust is functional.
Why it matters
Every trust is an authentication path. A user (or attacker holding a user) on the trusted side can request a Kerberos referral ticket for a service on the trusting side, and the trusting domain controller will honor it. Without a complete inventory, defenders cannot answer the basic questions that gate every cross-forest attack: which trusts exist, in which direction, with which mitigations applied. The specific risks an inventory exposes: - Forest trusts without SID filtering (Quarantined or EnableSIDHistory off) allow SID history injection: an attacker who controls the trusted forest can mint a TGT with an Enterprise Admin SID of the trusting forest in the SIDHistory field, and the trusting forest will honor it (the Mandiant Golden SAML / SID history pattern). - Bidirectional or outbound trusts where TGT delegation is enabled (CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION 0x800) let a compromised resource in the trusted forest harvest TGTs of users from the trusting forest and replay them, the unconstrained-delegation-across-a-trust primitive published by Will Schroeder and Lee Christensen. - External trusts to long-decommissioned partner domains where the trusted DC is now attacker-controlled (or sinkholed) become a free credential path into the environment. - Shortcut trusts inside a forest reduce referral latency but multiply the number of authentication paths between domains, complicating Tier-0 segmentation. - MIT realm trusts (trustType 3) to a third-party Kerberos KDC bypass AD account policy and logging entirely. The BloodHound trust map and every cross-forest attack path tool (Rubeus, Mimikatz lsadump::trust /patch, Impacket ticketer.py) start from the trust inventory this check produces. Defenders who do not have the same inventory are operating with less situational awareness than the adversary.
Attack path
1. Reconnaissance: from any authenticated user in any domain, the attacker runs Get-ADTrust -Filter * (or nltest /domain_trusts /all_trusts, or PowerView Get-DomainTrust -SearchScope Forest). No special privilege is required: trustedDomain objects are readable by Authenticated Users. 2. BloodHound ingestion: SharpHound -CollectionMethod Trusts builds the trust graph. Edges are labeled with trust type, transitivity, and SID-filter state pulled from trustAttributes. 3. Path selection: the attacker picks a trust whose SID filtering is disabled (forest trust without Quarantined, or any external trust pre-Server 2003), or one whose TGT delegation is enabled. 4. SID history injection (no SID filtering): with krbtgt of the trusted forest, the attacker forges a TGT containing an Enterprise Admin SID of the target forest in ExtraSids. Tools: mimikatz kerberos::golden /sids:<target-EA-SID> or impacket ticketer.py -extra-sid. The trusting DC accepts the referral and grants Tier-0 access. 4a. TGT delegation abuse (CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION 0x800 set): the attacker compels a target-forest user to authenticate to a resource in the trusted forest (printer bug, PetitPotam, malicious link). The trusted resource receives the users full TGT and replays it from anywhere. 5. Forgotten-trust exploitation: a trust to a partner that no longer maintains its DC is taken over by the attacker (typosquat the DNS name, stand up a rogue DC, sign Kerberos tickets with a recovered or known-weak trust key). 6. Persistence: trust keys (the inter-realm krbtgt) are extracted with lsadump::trust /patch from any DC and can be used to forge cross-forest tickets indefinitely unless the trust is reset on both sides.
How Guerrilla assesses it
Guerrilla enumerates trusts by binding to each domain in (Get-ADForest).Domains and calling Get-ADTrust -Filter * -Properties *. The check pulls the trustedDomain object from CN=System,<domain DN> with an LDAP filter of (objectClass=trustedDomain) and decodes the trustAttributes bitmask using the documented MS-ADTS constants. trustDirection and trustType are mapped to human-readable strings (Inbound / Outbound / Bidirectional and Forest / External / Shortcut / Realm / ParentChild / TreeRoot). For each trust the check also records whenCreated, whenChanged, the SID of the trusted domain, and whether the trust object has been modified in the last 90 days. The collector does not require elevated rights: any authenticated user can read trustedDomain objects. Results are emitted as one row per trust with all attributes resolved, which then feed the downstream ADTRUST-002 (SID filtering), ADTRUST-003 (TGT delegation), and ADTRUST-004 (selective authentication) checks.
Recommended value
All trust relationships documented with business justification, direction, type, and owner
Remediation
Run Get-ADTrust -Filter * to enumerate all trusts. Document each trust with its direction, type (forest, external, shortcut, realm), transitivity, and business justification. Review and remove any trusts that no longer serve a business need
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-20, CA-3
- CIS AD Benchmark
- 3.1.1
- MITRE ATT&CK
- T1482