Generate docs from job=validate_atomics_generate_docs branch=master

atomics/T1482/T1482.md

@@ -0,0 +1,40 @@
+# T1482 - Domain Trust Discovery
+## [Description from ATT&CK](https://attack.mitre.org/wiki/Technique/T1482)
+<blockquote>Adversaries may attempt to gather information on domain trust relationships that may be used to identify [Lateral Movement](https://attack.mitre.org/tactics/TA0008) opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain.(Citation: Microsoft Trusts) Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct [SID-History Injection](https://attack.mitre.org/techniques/T1178), [Pass the Ticket](https://attack.mitre.org/techniques/T1097), and [Kerberoasting](https://attack.mitre.org/techniques/T1208).(Citation: AdSecurity Forging Trust Tickets)(Citation: Harmj0y Domain Trusts) Domain trusts can be enumerated using the DSEnumerateDomainTrusts() Win32 API call, .NET methods, and LDAP.(Citation: Harmj0y Domain Trusts) The Windows utility [Nltest](https://attack.mitre.org/software/S0359) is known to be used by adversaries to enumerate domain trusts.(Citation: Microsoft Operation Wilysupply)</blockquote>
+
+## Atomic Tests
+
+- [Atomic Test #1 - Windows - Discover domain trusts with dsquery](#atomic-test-1---windows---discover-domain-trusts-with-dsquery)
+
+- [Atomic Test #2 - Windows - Discover domain trusts with nltest](#atomic-test-2---windows---discover-domain-trusts-with-nltest)
+
+
+<br/>
+
+## Atomic Test #1 - Windows - Discover domain trusts with dsquery
+Uses the dsquery command to discover domain trusts.
+Requires the installation of dsquery via Windows RSAT or the Windows Server AD DS role.
+
+**Supported Platforms:** Windows
+
+
+#### Run it with `command_prompt`!
+```
+dsquery * -filter "(objectClass=trustedDomain)" -attr *
+```
+<br/>
+<br/>
+
+## Atomic Test #2 - Windows - Discover domain trusts with nltest
+Uses the nltest command to discover domain trusts.
+Requires the installation of nltest via Windows RSAT or the Windows Server AD DS role.
+This technique has been used by the Trickbot malware family.
+
+**Supported Platforms:** Windows
+
+
+#### Run it with `command_prompt`!
+```
+nltest /domain_trusts
+```
+<br/>

atomics/index.md

@@ -423,7 +423,9 @@
 - [T1217 Browser Bookmark Discovery](./T1217/T1217.md)
   - Atomic Test #1: List Mozilla Firefox Bookmark Database Files on Linux [linux]
   - Atomic Test #2: List Mozilla Firefox Bookmark Database Files on macOS [macos]
-- T1482 Domain Trust Discovery [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
+- [T1482 Domain Trust Discovery](./T1482/T1482.md)
+  - Atomic Test #1: Windows - Discover domain trusts with dsquery [windows]
+  - Atomic Test #2: Windows - Discover domain trusts with nltest [windows]
 - [T1083 File and Directory Discovery](./T1083/T1083.md)
   - Atomic Test #1: File and Directory Discovery [windows]
   - Atomic Test #2: File and Directory Discovery [windows]