Active › Module 2 › Lesson 3
Trusts Named
Trusts name cross-domain authentication paths — recognize types on $LAB_AD maps; defenders minimize and monitor trust sprawl.
Visual · t25_trusts_named
Trust literacy. $LAB_AD only. Original Cyberlium.
Opening
A trust is a bridge between domains — literacy means naming direction and type, not hopping stranger forests.
Trust types include parent-child within a forest, external between forests, forest trusts, and shortcut trusts. Direction: one-way or two-way. Transitive trusts extend access paths — defenders document trust inventory; attack paths often cross trusts in lab scenarios. Cyberlium names trust types on YOUR $LAB_AD diagram — GOAD multi-domain labs are ideal — not enumerating corporate trust partners without authorization. Next: Structure Lab.
1. Trust types (named)
Parent-child: automatic two-way transitive within forest. External: between separate domains/forests — often one-way. Forest trust: between forest roots. Shortcut: optimize auth paths between distant domains.
On $LAB_AD, if multi-domain, label each trust arrow with type and direction on your map — literacy only.
Command guide
Try these commands — Trust types (named)
═══ WINDOWS / POWERSHELL (Active Directory Lab) ═══
Check current user, domain context, and security privileges
Command — copy this
whoami /user /groups /priv
Query active Domain Controller and trust relationships
Command — copy this
nltest /dsgetdc:$env:USERDOMAIN nltest /domain_trusts
List password policy across the domain
Command — copy this
net accounts /domain
Check Kerberos ticket cache
Command — copy this
klist
═══ LINUX / BASH (Lab Network) ═══ Test DNS SRV resolution for Active Directory services
Command — copy this
dig _ldap._tcp.dc._msdcs.lab.local SRV +short dig _kerberos._tcp.dc._msdcs.lab.local SRV +short
Primary tools to practice this lesson: curl, python3. Reference sites: AD trusts (https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/understanding-active-directory-trusts); MITRE domain trusts (https://attack.mitre.org/techniques/T1482/); adsecurity.org (https://adsecurity.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why trusts matter to defenders
Compromise in a trusted domain may affect trusting domains — blast radius expands. Defenders inventory trusts, remove stale externals, and monitor cross-domain admin use.
Purple-team reports name 'trust path' as finding class with remediation: minimize trusts, selective authentication, tiering.
3. Literacy ≠ unauthorized trust hopping
Forbidden: exploit trust paths on production partner forests. Allowed: trust legend on $LAB_AD map with two example trusts and defender monitoring note.
Ship: trust card — type, direction, transitive yes/no, one defender sentence. Next: Structure Lab.
4. What you ship: trust card for $LAB_AD
Trust type/direction table from YOUR lab map. Defender monitoring note. NO stranger trust enum. chmod 600.
5. What you record before the next lesson
Date. Trust card. $LAB_AD named. File t25-m02-l03-trusts-named.txt chmod 600.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Enumerate corporate trust partners without scope. Treat all trusts as 'free lateral movement recipes.'
Right
Write trust card from YOUR $LAB_AD map. Next: Structure Lab.
Mission: name trusts on YOUR lab map
1) Define parent-child vs external in one line each. 2) Document one trust on YOUR map if present. 3) Note defender inventory habit. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Stale external trusts are common audit findings.
Knowledge Check
APPLY: Trust literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: External trust often connects separate domains or forests.
True or False
Knowledge Check
APPLY: Defenders monitor trusts because:
Multiple choice