possible_system_owneruser_discovery_sysmonwindows_logs

rule possible_system_owneruser_discovery_sysmonwindows_logs {
 meta:
    author = "Roman Ranskyi"
    description = "Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system.  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/STD0YEfhpWU0"
    version = "0.01"
    created = "2021-03-09"
    product = "windows"
    service = "security"
    mitre = "Discovery, t1033"

  events:
(($selection0.target.process.command_line = "wmic" or $selection0.target.process.command_line = "useraccount get /ALL" or $selection0.target.process.command_line = "whoami") or ($selection0.target.process.file.full_path = "whoami.exe" or $selection0.target.process.file.full_path = "qwinsta.exe" or $selection0.target.process.file.full_path = "quser.exe"))

  condition:
    $selection0
}