SOC Event Lookup
Event ID 4706TrustP2

Windows Event ID 4706: A new trust was created to a domain

Applicable version
Windows Server 2008 R2 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 4706 records that a new Active Directory domain trust was created on a domain controller, logging the new trust's target domain, type, direction, and attribute bitmask.

Technical Metadata

Technical metadata for Event ID 4706
Event ID4706
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0004 Privilege Escalation / T1484.002 Domain or Tenant Policy Modification: Trust Modification
Key fields to watchTrust Information\Trust Type, Trust Information\Trust Direction, Trust Information\Trust Attributes, New Domain\Domain Name / Domain SID

Trigger Scenarios

A domain administrator runs netdom, the Active Directory Domains and Trusts console, or PowerShell to create a trust between the local domain and another. This is a low-frequency infrastructure operation and should only occur during planned directory changes.

Key Fields

Trust Information\Trust Type

The trust implementation type. Microsoft defines 1 as downlevel, 2 as uplevel Windows, 3 as MIT Kerberos, and 4 as DCE; forest scope is represented by the 0x8 FOREST_TRANSITIVE attribute, not Trust Type 2.

Trust Information\Trust Direction

The trust direction. Value 0 is disabled, 1 means the trusted domain trusts the primary domain, 2 means the primary domain trusts the trusted domain, and 3 is bidirectional.

Trust Information\Trust Attributes

A bitmask of additional trust properties. Bit 0x8 (FOREST_TRANSITIVE) means the trust is transitive across the entire trusted forest. Bit 0x10 (CROSS_ORGANIZATION) marks trusts across separate organizations. An unexpected 0x8 or 0x10 value in a new trust should be validated against the change ticket before the domain controller replicates the object.

New Domain\Domain Name / Domain SID

The trusted domain's name and SID. Verify these against the expected target domain documented in the change-management record; an unfamiliar domain name or SID indicates an unauthorized trust.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Event ID 4706
SecurityEvent
| where EventID == 4706
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Windows Event ID 4706
index=wineventlog source="WinEventLog:Security" EventCode=4706
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Windows Event ID 4706
dataset = microsoft_windows_raw
| filter edr_event_id = 4706
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4706
title: Windows Security Event ID 4706
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4706
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
TdoType2TRUST_TYPE_UPLEVEL: the trusted domain runs Windows 2000 or later.This is the common Windows-domain trust type, not a synonym for forest trust; scope is determined by direction and attribute bits. Source
TdoDirection3TRUST_DIRECTION_BIDIRECTIONAL: both domains trust one another for authentication and name lookups.An unapproved bidirectional trust expands authentication paths in both directions and has greater exposure than a one-way trust. Source
TdoAttributes0x8TRUST_ATTRIBUTE_FOREST_TRANSITIVE: the trust is a cross-forest trust between forest root domains.This bit establishes forest-transitive scope and must match the approved partner forest and SID-filtering design. Source

MITRE ATT&CK Mapping

  • T1484.002Domain or Tenant Policy Modification: Trust Modification

Detection Notes

T1484.002 Trust Modification applies to unapproved trust creation. Validate TdoType 2 as an uplevel Windows-domain trust, TdoDirection 3 as bidirectional, and TdoAttributes 0x8 as forest transitive; these values are distinct and must not be conflated. Compare DomainSid and SidFilteringEnabled with the approved partner and change record, then correlate SubjectLogonId to the creating administrator session.

Common False Positives

  • Planned Active Directory forest consolidations and organizational mergers create domain trusts with appropriate change-management approval.
  • Azure AD Connect or hybrid identity configurations create specific trust objects that are expected in hybrid deployments.

Related Events

  • Event ID 4707Content pending

Sample Log

Sanitized event sample
Subject:
  Security ID: CORP\svc-admin
  Account Name: svc-admin
  Account Domain: CORP
  Logon ID: 0x3F1E0
New Domain:
  Domain Name: partner.example
  Domain SID: S-1-5-21-9999999999-9999999999-9999999999
Trust Information:
  Trust Type: 2 (Uplevel)
  Trust Direction: 3 (Bidirectional)
  Trust Attributes: 8 (0x8 FOREST_TRANSITIVE)

Frequently Asked Questions

What does Windows Event ID 4706 mean?

Event ID 4706 records creation of an Active Directory domain trust and includes the actor, trusted-domain identity, trust type, direction, attributes, and SID-filtering state.

Does Trust Type 2 mean a forest trust?

No. Microsoft defines value 2 as TRUST_TYPE_UPLEVEL for Windows 2000 or later; the 0x8 FOREST_TRANSITIVE attribute identifies cross-forest trust scope.

Which 4706 values deserve immediate validation?

Every unplanned trust creation is high priority; specifically validate DomainSid, TdoDirection 3 bidirectional scope, TdoAttributes bits such as 0x8, and whether SID filtering is enabled.

Sources