Cross-source coverage

T1033 / ATT&CK

System Owner/User Discovery

85 rules · 83 families across 7 sources.

4 deprecated hidden · include

From MITRE ATT&CK 19.2

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping. The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Various utilities and commands may acquire this information, including whoami. In macOS and Linux, the currently logged in user can be identified with w and who. On macOS the dscl. list /Users | grep -v '_' command can also be used to enumerate user accounts. Environment variables, such as %USERNAME% and $USER, may also be used to access this information.

On network devices, Network Device CLI commands such as show users and show ssh can be used to display users currently logged into the device.

Tactics: Discovery
Platforms: Linux · macOS · Network Devices · Windows
Telemetry: WinEventLog:SysmonWinEventLog:PowerShellauditd:SYSCALLmacos:unifiedlogmacos:endpointsecuritynetworkdevice:syslog

How MITRE says to detect it DET0093

Behavioral Detection of User Discovery via Local and Remote Enumeration

Windows Analytic 0254

Adversary launches built-in system tools (e.g., whoami, query user, net user) or scripts that enumerate user account information via local execution or remote API queries (e.g., WMI, PowerShell).

WinEventLog:Sysmon EventCode=1
WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106

Linux Analytic 0255

Adversary runs commands like `whoami`, `id`, `w`, or `cat /etc/passwd` from non-interactive or scripting contexts to enumerate system user details.

auditd:SYSCALL execve

macOS Analytic 0256

Adversary uses `dscl`, `who`, or environment variables like `$USER` to identify accounts or sessions via Terminal or malicious LaunchAgents.

macos:unifiedlog subsystem:com.apple.Terminal
macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC

Network Devices Analytic 0257

Adversary executes CLI commands like `show users`, `show ssh`, or attempts to dump AAA user lists from routers or switches.

networkdevice:syslog aaa privilege_exec
networkdevice:syslog eventlog

View on attack.mitre.org ↗

SigmaHQ/sigma

30 rules

Detection	Severity	Format
Potential Dridex Activity	Critical	Sigma
Renamed Whoami Execution	Critical	Sigma
Chopper Webshell Process Pattern	High	Sigma
HackTool - SharpLdapWhoami Execution	High	Sigma
HackTool - SharpView Execution	High	Sigma
Possible DCSync Attack	High	Sigma
Security Privileges Enumeration Via Whoami.EXE	High	Sigma
SharpHound Recon Sessions	High	Sigma
Webshell Detection With Command Line Keywords	High	Sigma
Webshell Hacking Activity Patterns	High	Sigma

+ 20 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/detection-rules

17 rules

Detection	Severity	Format
Suspicious React Server Child Process	High	Elastic TOML
AWS STS GetCallerIdentity API Called for the First Time	Medium	Elastic TOML
Discovery Command Output Written to Suspicious File	Medium	Elastic TOML
Potentially Suspicious Process Started via tmux or screen	Medium	Elastic TOML
Suspicious JetBrains TeamCity Child Process	Medium	Elastic TOML
Suspicious MS Office Child Process	Medium	Elastic TOML
Unusual User Privilege Enumeration via id	Medium	Elastic TOML
Account Discovery Command via SYSTEM Account	Low	Elastic TOML
Enumeration Command Spawned via WMIPrvSE	Low	Elastic TOML
Passwordless Sudo Probing	Low	Elastic TOML

+ 7 more from elastic/detection-rules → showing the 10 highest-severity

splunk/security_content

16 rules

Detection	Severity	Format
Check Elevated CMD using whoami	Undefined	SPL
GetCurrent User with PowerShell	Undefined	SPL
GetCurrent User with PowerShell Script Block	Undefined	SPL
Linux Auditd Whoami User Discovery	Undefined	SPL
Linux Root Execution of id	Undefined	SPL
System User Discovery With Query	Undefined	SPL
System User Discovery With Whoami	Undefined	SPL
User Discovery With Env Vars PowerShell	Undefined	SPL
User Discovery With Env Vars PowerShell Script Block	Undefined	SPL
Windows Common Abused Cmd Shell Risk Behavior	Undefined	SPL

+ 6 more from splunk/security_content → showing the 10 highest-severity

socfortress/Wazuh-Rules

10 rules · 9 families

Detection	Severity	Format
Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. 2 variants	High	Wazuh XML
Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. 2 variants	High	Wazuh XML
System Owner/User Discovery via {{process_exec.process.binary}} (T1033)	High	Wazuh XML
Sysmon - Event 12: RegistryEvent (Object create and delete) by · System Owner/User Discovery (T1033)	Low	Wazuh XML
Sysmon - Event 13: RegistryEvent (Value Set) by · System Owner/User Discovery (T1033)	Low	Wazuh XML
Sysmon - Event 14: RegistryEvent (Key and Value Rename) by · System Owner/User Discovery (T1033)	Low	Wazuh XML
Sysmon - Event 17: PipeEvent (Pipe Created) by · System Owner/User Discovery (T1033)	Low	Wazuh XML
Sysmon - Event 18: PipeEvent (Pipe Connected) by · System Owner/User Discovery (T1033)	Low	Wazuh XML
Sysmon - Event 1: Process creation · System Owner/User Discovery (T1033)	Low	Wazuh XML
Sysmon - Event 3: Network connection by · System Owner/User Discovery (T1033)	Low	Wazuh XML

Wazuh Core Ruleset

5 rules · 4 families

Detection	Severity	Format
Gathered user information from Remote Desktop Service sessions 2 variants	Low	Wazuh XML
Gathered user information from Remote Desktop Service sessions 2 variants	Low	Wazuh XML
Powershell executed "GetUserNameEx". Possible user information discovery	Low	Wazuh XML
Powershell queried Win32_ComputerSystem. Possible system discovery activity	Low	Wazuh XML
Powershell script executed "ConvertSidToStringSid" API. Possible domain SID enumeration	Low	Wazuh XML

elastic/protections-artifacts

4 rules

Detection	Severity	Format
Dscl Execution via Osascript	Undefined	Elastic TOML
Initial Access Discovery via Applet Executable	Undefined	Elastic TOML
Suspicious Dscl Auth Validation	Undefined	Elastic TOML
User Discovery Command Execution from Volume Mount	Undefined	Elastic TOML

chronicle/detection-rules

3 rules

Detection	Severity	Format
local_accounts_discovery	Low	YARA-L
recon_successful_logon_enumeration_powershell_T1033_cisa_report	Informational	YARA-L
whoami_execution	Informational	YARA-L