Rule name: "Skopnix: AdFind domain trust or controller enumeration (T1482)"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [Microsoft Windows Security Event Log, Microsoft Windows Sysmon]
  - and when the event matches this AQL filter query: "Process Name" ILIKE 'adfind.exe' AND ("Process CommandLine" ILIKE '%trustdmp%' OR "Process CommandLine" ILIKE '%dclist%' OR "Process CommandLine" ILIKE '%domainlist%')
Response: dispatch new event / create offense indexed by Source IP; annotate "Skopnix T1482".
FP-safety: Requires adfind plus a trust / DC enumeration switch; generic LDAP queries with other tools do not match.