Creating Unknown trust attribute, but not recording it

SpecterOps · Mar 18, 2024 · f7538d6 · f7538d6
1 parent 612ebe7
commit f7538d6
Show file tree

Hide file tree

Showing 3 changed files with 2 additions and 7 deletions.
diff --git a/src/CommonLib/Enums/TrustAttributes.cs b/src/CommonLib/Enums/TrustAttributes.cs
@@ -16,7 +16,6 @@ public enum TrustAttributes
         TrustUsesAes = 0x100,
         CrossOrganizationNoTGTDelegation = 0x200,
         PIMTrust = 0x400,
-        // We believe this deprecated flag represents a parent/child relationship
-        DeprecatedParentChild = 0x400000,
+        Unknown = 0x400000,
     }
 }
diff --git a/src/CommonLib/Processors/DomainTrustProcessor.cs b/src/CommonLib/Processors/DomainTrustProcessor.cs
@@ -90,7 +90,7 @@ public static TrustType TrustAttributesToType(TrustAttributes attributes)
         {
             TrustType trustType;
 
-            if (attributes.HasFlag(TrustAttributes.WithinForest) || attributes.HasFlag(TrustAttributes.DeprecatedParentChild))
+            if (attributes.HasFlag(TrustAttributes.WithinForest))
                 trustType = TrustType.ParentChild;
             else if (attributes.HasFlag(TrustAttributes.ForestTransitive))
                 trustType = TrustType.Forest;

diff --git a/test/unit/DomainTrustProcessorTest.cs b/test/unit/DomainTrustProcessorTest.cs
@@ -109,10 +109,6 @@ public void DomainTrustProcessor_TrustAttributesToType()
             var test = DomainTrustProcessor.TrustAttributesToType(attrib);
             Assert.Equal(TrustType.ParentChild, test);
 
-            attrib = TrustAttributes.DeprecatedParentChild;
-            test = DomainTrustProcessor.TrustAttributesToType(attrib);
-            Assert.Equal(TrustType.ParentChild, test);
-
             attrib = TrustAttributes.ForestTransitive;
             test = DomainTrustProcessor.TrustAttributesToType(attrib);
             Assert.Equal(TrustType.Forest, test);