Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Conti – PowerView/SharpView Domain-Trust Enumeration

Conti Discovery Sentinel
MITRE ATT&CK
Domain Trust Discovery
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (conti)
What This Detects
Ahead of its Rubeus/PsExec lateral-movement stage, Conti runs PowerView and SharpView (alongside AdFind/Bloodhound) specifically for domain-trust enumeration — a signal worth separating from the later credential-abuse step.
Query
DeviceProcessEvents
| where Timestamp > ago(1d)
| where ProcessCommandLine has_any ("Get-DomainTrust","Get-NetDomainTrust","PowerView","SharpView")
| project Timestamp, DeviceName, ProcessCommandLine, AccountName

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.