BIOC
Informational
✕
Active directory enumeration using built-in nltest.exe
Nltest.exe is a command-line tool used for network administrative tasks, and can be used to gather information about domain controllers and users.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Discovery
- Status:
- Enabled
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: Remote System Discovery (T1018) Account Discovery (T1087) Domain Trust Discovery (T1482)
Indicator:
Process action type = execution AND target process name = nltest.exe
Preventable: yes