<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-ad-forest-trust-security
description: >-
  Secure Active Directory forest trust configurations by auditing trust relationships, SID filtering, selective authentication, and cross-forest attack paths.
domain: cybersecurity
subdomain: active-directory-security
tags:
  - forest-trust
  - sid-filtering
  - trust-abuse
  - cross-forest
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1134.005"]
  frameworks: ["MITRE ATT&CK", "Microsoft"]
  tools: ["powershell", "bloodhound", "mimikatz"]
---

# Implementing Ad Forest Trust Security

## Overview

Secure Active Directory forest trust configurations by auditing trust relationships, SID filtering, selective authentication, and cross-forest attack paths.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `powershell` | Security tooling |
| `bloodhound` | Security tooling |
| `mimikatz` | Security tooling |
| Enterprise Admin access, multi-forest environment, BloodHound | Environment requirement |

## Quick Reference

```bash
# Quick start commands
node scripts/agent.js --help
Get-ADTrust -Filter * | Select-Object Name,Direction,TrustType,SIDFilteringForestAware
```

## Workflow

### Step 1: Enumerate Forest Trusts

```bash
Get-ADTrust -Filter * | Select-Object Name,Direction,TrustType,SIDFilteringForestAware
```

### Step 2: Verify SID Filtering

```bash
node scripts/agent.js audit --domain corp.local --trust partner.local
```

### Step 3: Harden Trust Configuration

```bash
Set-ADTrust -Identity partner.local -SIDFilteringForestAware $true
```

## Detection

```yaml
title: Ad Forest Trust Security Detection
id: f1f0e5f0-b4ec-499e-bbe9-794168039f45
status: experimental
description: Detects suspicious activity related to implementing ad forest trust security techniques in active directory security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*implementing*ad*"
  condition: selection
level: medium
tags:
  - attack.t1134.005
  - attack.credential_access
falsepositives:
  - Authorized Active Directory administration using approved management tools
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Ad Forest Trust Security Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1134.005 |

## Verification

- **Verify trust enumeration**: `node scripts/agent.js enumerate --domain corp.local`
- **Confirm SID filtering**: `node scripts/agent.js audit --domain corp.local --trust partner.local`

## References

- MITRE ATT&CK: T1134.005
- Frameworks: MITRE ATT&CK, Microsoft
- Tools: powershell, bloodhound, mimikatz
