Nltest
MITRE ATT&CK: S0359 View on attack.mitre.org
Aliases: Nltest
- Operating systems
- windows
- Profile updated
- 2026-07-07 15:33:16
Context
Nltest is a Windows command-line utility used to list domain controllers and enumerate domain trusts.
Detection coverage
- 42 Sigma rules
Malware & tools used
- Domain Trust Discovery (attack-pattern)
- Remote System Discovery (attack-pattern)
- System Network Configuration Discovery (attack-pattern)
Used by threat actors
- Wizard Spider (threat-actor)
- Earth Lusca (threat-actor)
- Volt Typhoon (threat-actor)
- INC Ransom (threat-actor)
- Storm-0501 (threat-actor)
- Play (threat-actor)
- FIN8 (threat-actor)
- MirrorFace (threat-actor)
Reports & references
- MITRE ATT&CK — S0359 (report)
- ss64.com — Nltest (report)