MirrorFaceG1054 ↗
Has used Windows native tools to enumerate user information.1
tfMITRE ATT&CK technique
System Owner/User Discovery T1033
- Tactic
- Discovery
- Platforms
- Linux, macOS, Network Devices, Windows
- Version
- 1.6
- Created
- 31 May 2017
- Last modified
- 12 May 2026
- Contributor
- Austin Clark, @c2defense
Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping. The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
40
Threat groupsTop 4%
Threat groups96th percentile · 96% of ATT&CK techniques have this many threat groups attributed or fewer.8
CampaignsTop 5%
Campaigns95th percentile · 95% of ATT&CK techniques have this many campaigns recorded or fewer.196
Tools & malwareTop 2%
Tools & malware98th percentile · 98% of ATT&CK techniques have this many tools implementing them or fewer.47
Detection rulesTop 5%
Detection rules95th percentile · 95% of ATT&CK techniques have this many detection rules written or fewer.System Owner/User Discovery MITRE reference T1033
Top 4%of all ATT&CK techniques for number of groups
40 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Medusa GroupG1051 ↗
Has utilized PsExec to execute quser to discover the user session information.1
Storm-1811G1046 ↗
Has used whoami.exe to determine if the active user on a compromised system is an administrator.1
Moonstone SleetG1036 ↗
Deployed various malware such as YouieLoader that can perform system user discovery actions.1
Winter VivernG1035 ↗
PowerShell scripts execute whoami to identify the executing user.1
Volt TyphoonG1017 ↗
Has used public tools and executed the PowerShell command Get-EventLog security -instanceid 4624 to identify associated user and computer account names.123
All 40 groups for this technique · 6 newest in this preview
8 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
SharePoint ToolShell ExploitationC0058 ↗
During SharePoint ToolShell Exploitation, threat actors executed whoami on victim machines to enumerate user context and validate privilege levels.12
Operation Digital EyeC0061 ↗
During Operation Digital Eye, threat actors used GetUserInfo to identify current user information.1
C0018C0018 ↗
During C0018, the threat actors collected whoami information via PowerShell scripts.1
C0017C0017 ↗
During C0017, APT41 used whoami to gather information from victim machines.1
Operation CuckooBeesC0012 ↗
During Operation CuckooBees, the threat actors used the query user and whoami commands as part of their advanced reconnaissance.1
FrankensteinC0001 ↗
During Frankenstein, the threat actors used Empire to enumerate hosts and gather username, machine name, and administrative permissions information.1
All 8 campaigns for this technique · 6 newest in this preview
196 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Mini Shai-HuludS9043 ↗
Has leveraged commands such as whoami to identify the system owner.1
CanisterWormS9042 ↗
Has parsed the /var/log/auth.log and /var/log/secure files for usernames.1
TeamPCP Cloud StealerS9041 ↗
Can use whoami on self-hosted runners to identify the current user.1
RustyWaterS9037 ↗
Has gathered the victim machine’s username.1
LAMEHUGS9035 ↗
Can use whoami to enumerate the system user.1
IronWindS9029 ↗
Can enumerate the username on victim's systems.1
All 196 software entries for this technique · 6 newest in this preview
Offense vs defense T1033
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 7Sigma rules (cumulative) · 31Splunk ESCU (cumulative) · 16
first rule: 2017 Q1 · 7 of 8 campaigns plotted (Night Dragon (dated 2009) falls before the 2014 window)System Owner/User Discovery detection strategy DET0093
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection of User Discovery via Local and Remote Enumeration
4 platforms
AN0254 · Windows
Adversary launches built-in system tools (e.g., whoami, query user, net user) or scripts that enumerate user account information via local execution or remote API queries (e.g., WMI, PowerShell).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Command ExecutionDC0064 | WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ParentProcessContext | Identify if enumeration originates from non-interactive shell or system service |
| TimeWindow | Tune temporal grouping of enumeration + lateral movement attempts |
| UserContext | Flag unexpected users issuing enumeration commands (e.g., service accounts) |
AN0255 · Linux
Adversary runs commands like whoami, id, w, or cat /etc/passwd from non-interactive or scripting contexts to enumerate system user details.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CommandLineRegex | Tune detection based on argument presence (e.g., cat /etc/passwd vs. cat alone) |
| ShellContext | Identify if command issued via cron, systemd, or reverse shell |
| AccessFrequency | Define how often user/account commands are expected on endpoint |
AN0256 · macOS
Adversary uses dscl, who, or environment variables like $USER to identify accounts or sessions via Terminal or malicious LaunchAgents.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:endpointsecurity | ES_EVENT_TYPE_NOTIFY_EXEC |
| Command ExecutionDC0064 | macos:unifiedlog | subsystem:com.apple.Terminal |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| LaunchAgentPersistence | Correlate dscl usage with known persistence vectors |
| CommandExecutionPath | Distinguish between user-initiated terminal vs. script execution |
| UsernameEnumerationPattern | Regex-based pattern tuning for dscl . -list /Users + grep filters |
AN0257 · Network Devices
Adversary executes CLI commands like show users, show ssh, or attempts to dump AAA user lists from routers or switches.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| OS API ExecutionDC0021 | networkdevice:syslog | aaa privilege_exec |
| Command ExecutionDC0064 | networkdevice:syslog | eventlog |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CLICommandBaseline | Expected command set per device role/user role combination |
| DeviceRoleSensitivity | Correlate access with core vs. edge vs. management plane sensitivity |
| CommandFrequencyThreshold | Detect burst usage of show or debug commands by non-admin users |
2 analytics
Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PLA | Process Lineage Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | hostname |
| process | create | ppid |
| process | create | exe |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
processes = search Process:Create reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe" or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe" or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe" or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe" or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe" or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe" or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe" or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe" or exe == "wscript.exe" or exe == "xcopy.exe") reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes) output reg_grouped
Sigma version of the above pseudocode, with some modifications.
DNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100 >>_agg count >>_checkif int_compare Count > 1 include
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 image IN ["*\arp.exe", "*\at.exe", "*\attrib.exe", "*\cscript.exe", "*\dsquery.exe", "*\hostname.exe", "*\ipconfig.exe", "*\mimikatz.exe", "*\nbstat.exe", "*\net.exe", "*\netsh.exe", "*\nslookup.exe", "*\ping.exe", "*\quser.exe", "*\qwinsta.exe", "*\reg.exe", "*\runas.exe", "*\sc.exe", "*\schtasks.exe", "*\ssh.exe", "*\systeminfo.exe", "*\taskkill.exe", "*\telnet.exe", "*\tracert.exe", "*\wscript.exe", "*\xcopy.exe"] | chart count() as cnt by host | search cnt > 1
Unit tests
CAR’s own validation procedures for this analytic.
Within a command window, execute several of the commands in quick succession.
["ipconfig /all","hostname","systeminfo","reg.exe Query HKLM\\Software\\Microsoft"]
When entering on a host for the first time, an adversary may try to discover information about the host. There are several built-in Windows commands that can be used to learn about the software configurations, active users, administrators, and networking configuration. These commands should be monitored to identify when an adversary is learning information about the system and environment. The information returned may impact choices an adversary can make when establishing persistence, escalating privileges, or moving laterally.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PSA | Process Spawn Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | command_line |
| process | create | exe |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
To be effective in deciphering malicious and benign activity, the full command line is essential. Similarly, having information about the parent process can help with making decisions and tuning to an environment.
process = search Process:Create info_command = filter process where ( exe == "hostname.exe" or exe == "ipconfig.exe" or exe == "net.exe" or exe == "quser.exe" or exe == "qwinsta.exe" or exe == "sc" and (command_line match " query" or command_line match " qc")) or exe == "systeminfo.exe" or exe == "tasklist.exe" or exe == "whoami.exe" ) output info_command
Splunk version of the above pseudocode search.
index=__your_sysmon_index__ EventCode=1 (Image="C:\\Windows\\*\\hostname.exe" OR Image="C:\\Windows\\*\\ipconfig.exe" OR Image="C:\\Windows\\*\\net.exe" OR Image="C:\\Windows\\*\\quser.exe" OR Image="C:\\Windows\\*\\qwinsta.exe" OR (Image="C:\\Windows\\*\\sc.exe" AND (CommandLine="* query *" OR CommandLine="* qc *")) OR Image="C:\\Windows\\*\\systeminfo.exe" OR Image="C:\\Windows\\*\\tasklist.exe" OR Image="C:\\Windows\\*\\whoami.exe")|stats values(Image) as "Images" values(CommandLine) as "Command Lines" by ComputerName
EQL version of the above pseudocode search.
process where subtype.create and (process_name == "hostname.exe" or process_name == "ipconfig.exe" or process_name == "net.exe" or process_name == "quser.exe" process_name == "qwinsta.exe" or process_name == "systeminfo.exe" or process_name == "tasklist.exe" or process_name == "whoami.exe" or (process_name == "sc.exe" and (command_line == "* query *" or command_line == "* qc *")))
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 (image in ["*\hostname.exe", "*\ipconfig.exe", "*\net.exe", "*\quser.exe", "*\qwinsta.exe", "*\systeminfo.exe", "*\tasklist.exe", "*\whoami.exe"] OR (image="*\sc.exe" command IN ["* query *", "* qc *"))
Tests7ExecutorsPowerShell 4 · cmd 2 · sh 1Need elevation0 of 7Have prerequisites0Have cleanup4Platformswindows, linux, macos
Tests from Atomic Red Team (MIT licence) · technique definition