CrossForestTrust

The CrossForestTrust edge represents a trust relationship between two domains/forests. In this relationship, the source node domain has a cross-forest (interforest) trust to the destination node domain, allowing principals (users and computers) from the destination domain to access resources in the source domain.

Abuse Info

The cross-forest trust does not enable a compromise of any of the domains by default.

BloodHound creates separate traversable edges between the domains if the configuration of the trust enables abuse.

Opsec Considerations

There is no OPSEC associated with this edge.

Edge Schema

Source: Domain
Destination: Domain
Traversable: Yes

References

• Microsoft AD Trust Technical Documentation
• Good Fences Make Good Neighbors: New AD Trusts Attack Paths in BloodHound