H3XA — Operational Evidence

TypeTool

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Nltest](https://attack.mitre.org/software/S0359) is a Windows command-line utility used to list domain controllers and enumerate domain trusts.(Citation: Nltest Manual)

Labels

tool

11 recorded

Relationships

uses

from Earth Lusca

Group

uses

from FIN8

Group

uses

from INC Ransom

Group

uses

from MirrorFace

Group

uses

to Domain Trust Discovery

Technique

uses

to Remote System Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

from Play

Group

uses

from Storm-0501

Group

uses

from Volt Typhoon

Group

uses

from Wizard Spider

Group

2 external

References

mitre-attack

S0359

open

Nltest Manual

https://ss64.com/nt/nltest.html

open