Adversaries may gather information about trust relationships in Windows multi-domain or forest environments to identify potential paths between domains. This information may inform follow-on techniques such as SID-History Injection, Pass the Ticket, or Kerberoasting; those actions are separate from trust discovery.
Check before starting: RESTRICTED_ACCESS_BLUR_MARKER
Variant:
Full outcome coverage
ADExplorerSnapshot · Convert Snapshot to BOFHound
Convert Snapshot to BOFHound
powershell
RESTRICTED_ACCESS_BLUR_MARKER
Version: RESTRICTED_ACCESS_BLUR_MARKER. Requirements: ALL(RESTRICTED_ACCESS_BLUR_MARKER)Documents all requested outcomes. This is a candidate, not proof of execution or compatibility.preconditions: RESTRICTED_ACCESS_BLUR_MARKERdependencies: RESTRICTED_ACCESS_BLUR_MARKERverification: RESTRICTED_ACCESS_BLUR_MARKERlimitations: RESTRICTED_ACCESS_BLUR_MARKER