Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping. The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Various utilities and commands may acquire this information, including whoami. In macOS and Linux, the currently logged in user can be identified with w and who. On macOS the dscl . list /Users | grep -v '_' command can also be used to enumerate user accounts. Environment variables, such as %USERNAME% and $USER, may also be used to access this information.
On network devices, Network Device CLI commands such as show users and show ssh can be used to display users currently logged into the device.[1][2]
Top 4%of all ATT&CK techniques for number of groups
40 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has used public tools and executed the PowerShell command Get-EventLog security -instanceid 4624 to identify associated user and computer account names.123
created 2023-07-273 referencesaka BRONZE SILHOUETTE
All 40 groups for this technique · 6 newest in this preview
8 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
During Frankenstein, the threat actors used Empire to enumerate hosts and gather username, machine name, and administrative permissions information.1
2019
All 8 campaigns for this technique · 6 newest in this preview
196 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
System Owner/User Discovery detection strategy DET0093
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection of User Discovery via Local and Remote Enumeration
Enterprise
4 platforms
AN0254 · Windows
Adversary launches built-in system tools (e.g., whoami, query user, net user) or scripts that enumerate user account information via local execution or remote API queries (e.g., WMI, PowerShell).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
CLICommandBaseline
Expected command set per device role/user role combination
DeviceRoleSensitivity
Correlate access with core vs. edge vs. management plane sensitivity
CommandFrequencyThreshold
Detect burst usage of show or debug commands by non-admin users
2 analytics
Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.
TypeTTPCoverageLowSubmitted2013
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
processes = search Process:Create
reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe"
or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe"
or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe"
or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe"
or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe"
or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe"
or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe"
or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe"
or exe == "wscript.exe" or exe == "xcopy.exe")
reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes)
output reg_grouped
Sigma version of the above pseudocode, with some modifications.
DNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100
>>_agg count
>>_checkif int_compare Count > 1 include
When entering on a host for the first time, an adversary may try to discover information about the host. There are several built-in Windows commands that can be used to learn about the software configurations, active users, administrators, and networking configuration. These commands should be monitored to identify when an adversary is learning information about the system and environment. The information returned may impact choices an adversary can make when establishing persistence, escalating privileges, or moving laterally.
TypeTTPCoverageModerateSubmitted2016
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
To be effective in deciphering malicious and benign activity, the full command line is essential. Similarly, having information about the parent process can help with making decisions and tuning to an environment.
process = search Process:Create
info_command = filter process where (
exe == "hostname.exe" or
exe == "ipconfig.exe" or
exe == "net.exe" or
exe == "quser.exe" or
exe == "qwinsta.exe" or
exe == "sc" and (command_line match " query" or command_line match " qc")) or
exe == "systeminfo.exe" or
exe == "tasklist.exe" or
exe == "whoami.exe"
)
output info_command
Splunk version of the above pseudocode search.
index=__your_sysmon_index__ EventCode=1 (Image="C:\\Windows\\*\\hostname.exe" OR Image="C:\\Windows\\*\\ipconfig.exe" OR Image="C:\\Windows\\*\\net.exe" OR Image="C:\\Windows\\*\\quser.exe" OR Image="C:\\Windows\\*\\qwinsta.exe" OR (Image="C:\\Windows\\*\\sc.exe" AND (CommandLine="* query *" OR CommandLine="* qc *")) OR Image="C:\\Windows\\*\\systeminfo.exe" OR Image="C:\\Windows\\*\\tasklist.exe" OR Image="C:\\Windows\\*\\whoami.exe")|stats values(Image) as "Images" values(CommandLine) as "Command Lines" by ComputerName
EQL version of the above pseudocode search.
process where subtype.create and
(process_name == "hostname.exe" or process_name == "ipconfig.exe" or process_name == "net.exe" or process_name == "quser.exe" process_name == "qwinsta.exe" or process_name == "systeminfo.exe" or process_name == "tasklist.exe" or process_name == "whoami.exe" or (process_name == "sc.exe" and (command_line == "* query *" or command_line == "* qc *")))
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 (image in ["*\hostname.exe", "*\ipconfig.exe", "*\net.exe", "*\quser.exe", "*\qwinsta.exe", "*\systeminfo.exe", "*\tasklist.exe", "*\whoami.exe"] OR (image="*\sc.exe" command IN ["* query *", "* qc *"))
Tests8Executorspowershell 4 · command_prompt 3 · sh 1Need elevation0 of 8Have prerequisites0Have cleanup4Platformswindows, linux, macos
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
System Owner/User Discovery
windows
command_prompt
—
—
—
Identify System owner or users on an endpoint.
Upon successful execution, cmd.exe will spawn multiple commands against a target host to identify usernames. Output will be via stdout.
Additionally, two files will be written to disk - computers.txt and usernames.txt.
Inputs
Name
Description
Type
Default Value
computer_name
Name of remote computer
string
localhost
Attack Commandsrun with command_prompt
cmd.exe /C whoami
wmic useraccount get /ALL
quser /SERVER:"#{computer_name}"
quser
qwinsta.exe /server:#{computer_name}
qwinsta.exe
for /F "tokens=1,2" %i in ('qwinsta /server:#{computer_name} ^| findstr "Active Disc"') do @echo %i | find /v "#" | find /v "console" || echo %j > computers.txt
@FOR /F %n in (computers.txt) DO @FOR /F "tokens=1,2" %i in ('qwinsta /server:%n ^| findstr "Active Disc"') do @echo %i | find /v "#" | find /v "console" || echo %j > usernames.txt
GUID4c4959bf-addf-4b4a-be86-8d09cc1857aa
02
System Owner/User Discovery
linux, macos
sh
—
—
—
Identify System owner or users on an endpoint
Upon successful execution, sh will stdout list of usernames.
Attack Commandsrun with sh
users
w
who
GUID2a9b677d-a230-44f4-ad86-782df1ef108c
03
Find computers where user has session - Stealth mode (PowerView)
windows
powershell
—
—
—
Find existing user session on other computers. Upon execution, information about any sessions discovered will be displayed.
SocGholish performs whoami discovery commands and outputs the results to a tmp file.
The test will generate a filename similar to the random one generated during execution and write the file to AppData\Temp.
Reference: https://redcanary.com/threat-detection-report/threats/socgholish/
Identify the system owner or current user using native Windows command prompt utilities.
Inputs
Name
Description
Type
Default Value
output_file_path
Location of output file.
string
$env:temp
Attack Commandsrun with command_prompt
set file=#{output_file_path}\user_info_%random%.tmp
echo Username: %USERNAME% > %file%
echo User Domain: %USERDOMAIN% >> %file%
net users >> %file%
query user >> %file%
Cleanup Commands
del #{output_file_path}\\user_info_*.tmp
GUIDba38e193-37a6-4c41-b214-61b33277fe36
08
User Discovery - whoami
windows
command_prompt
—
—
—
Identify the current user account and security context using whoami. Adversaries use this command during initial
reconnaissance after gaining access to a system to determine the user and privilege level they are operating under.
Inputs
Name
Description
Type
Default Value
whoami_args
Arguments to pass to whoami (e.g. /all, /priv, /groups, /user)
Top 5%of all ATT&CK techniques for number of rules
Showing 1-47 of 47 rules
Drag headers to reorder | Drag edges to resize
Select
Title
Description
Category
Status
Event
OS
Product
MITRE ATT&CK
CVEs
Severity
Author
Created
Updated
ID
Refs
Splunk
The following analytic identifies the execution of the "whoami" command with the "/group" flag, where the results are passed to the "find" command in order to look for a the string "12288". (...)
Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. (...)
The following analytic detects the execution of `powershell.exe` with command-line arguments invoking the `GetCurrent` method of the WindowsIdentity .NET class. (...)
The following analytic detects the execution of the `GetCurrent` method from the WindowsIdentity .NET class using PowerShell Script Block Logging (EventCode=4104). (...)
Detects the execution of whoami.exe with the /group command line flag to show group membership for the current user, account type, security identifiers (SID), and attributes.
The following analytic detects the suspicious use of the whoami command, which may indicate an attacker trying to gather information about the current user account on a compromised system. (...)
The following analytic detects the execution of `powershell.exe` with command-line arguments that use PowerShell environment variables to identify the current logged user. (...)
The following analytic detects the use of PowerShell environment variables to identify the current logged user by leveraging PowerShell Script Block Logging (EventCode=4104). (...)
Florian Roth (Nextron Systems), Teymur Kheirkhabarov
2022-01-28
2023-12-04
79ce34ca-af29-4d0e-b832-fc1b377020db
Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to export the results to a file for later use.
The following analytic identifies instances where four or more distinct detection analytics are associated with malicious command line behavior on a specific host. (...)
The following analytic detects the execution of the Windows OS tool quser.exe, commonly used to gather information about user sessions on a Remote Desktop Session Host server. (...)
The following analytic detects the execution of `whoami.exe` with the `/priv` parameter, which displays the privileges assigned to the current user account. (...)