Nltest

Nltest is a Windows command-line utility used to list domain controllers and enumerate domain trusts.[1]

ID: S0359
Type: TOOL
Platforms: Windows
Version: 1.1
Created: 14 February 2019
Last Modified: 07 October 2021

Techniques Used

Domain ID Name Use
Enterprise T1482 Domain Trust Discovery

Nltest may be used to enumerate trusted domains by using commands such as nltest /domain_trusts.[1][2]

Enterprise T1018 Remote System Discovery

Nltest may be used to enumerate remote domain controllers using options such as /dclist and /dsgetdc.[1]

Enterprise T1016 System Network Configuration Discovery

Nltest may be used to enumerate the parent domain of a local machine using /parentdomain.[1]

Groups That Use This Software

ID Name References
G0061 FIN8

[3]

G0102 Wizard Spider

[4][5][6][7][8][9]

References