A new domain trust was created. TrustedDomainName and TrustType are key.
Rogue domain trust creation enables cross-domain authentication for attacker-controlled domains. Used in advanced persistence scenarios. Any unexpected trust creation is a critical indicator.
Alert on every occurrence. Verify with active change management — domain trusts should only be created by documented admin actions.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName | Tactic | Technique |
|---|---|
| Persistence | Domain Trust Modification (T1484.002) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4706 // A new trust was created to a domain
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
index=* sourcetype="WinEventLog:Security" EventCode=4706
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A new trust was created to a domain — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
A new trust was created to a domain. A new domain trust was created. TrustedDomainName and TrustType are key.
Event 4706 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Policy Change' subcategory (Success and/or Failure).
Event 4706 is associated with: Domain Trust Modification (T1484.002).
Alert on every occurrence. Verify with active change management — domain trusts should only be created by documented admin actions.