Identity and trust discovery
Identity and trust discovery is the process of mapping how users, groups, roles, services, and systems grant and propogate access in an environment. It focuses on understanding how authority is structured and inherited, and does not include exploitation or privilege abuse.
Strategic context
The primary goal when conducting external and internal reconnaissance is to map the environment and identify potential attacks paths. During identity and trust reconnaissance an attacker is attempting to identify who has the privileges to access resources of interest. Most enterprise environments aren't compromised because of a single vulnerable service. They are compromised because identity relationships or configuration provide a path to expanded access. Understanding identity relationships is often more valuable to an attacker than additional system discovery.
For security leaders, this phase highlights whether access control was implemented in a disciplined fashion aligned with least privilege principles. Nested groups, delegated privileges, service accounts, and cross domain trusts frequently create unintentional authority pathways.
Execution examples
Good identity and trust discovery begins from local context and expands outward to domain and enterprise relationships.
Local identity and groups
Although local identity enumeration was introduced during internal reconnaissance, it is revisited here with a different objective: understanding how authority is inherited and expanded.
# Windows
whoami (current user)
whoami /groups (group membership)
net localgroup (local groups)# Powershell
[System.Security.Principal.WindowsIdentity]::GetCurrent().Name (current id)
Get-LocalGroupMember -Group "Administrators" (local Admin group membership)
Get-LocalGroup (local groups)# Linux
id (current user and group membership)
cat /etc/group (local groups)Domain identity mapping (Active Directory)
In domain-joined environments, authority/permissions are centralized and delegated through structured trust relationships.
Trust relationship and delegation
Trust relationships define how authority extends between domain and systems.
Common mistakes
Treating identity discovery as privilege escalation
Focusing only on high-profile groups
Overlooking cross-domain trust relationships
Operator notes
Identity relationships are commonly more valuable than exposed services
Delegation can expand privileges quietly
Map authority and FULLY understand possible paths before attempting escalation
Last updated