Techniques › T1033
T1033 System Owner/User Discovery
discovery — Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
30
Sigma rules tagged attack.t1033
2
KEV CVEs mapped here
<p>Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping. The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.</p><p>Various utilities and commands may acquire this information, including <code>whoami</code>. In macOS and Linux, the currently logged in user can be identified with <code>w</code> and <code>who</code>. On macOS the <code>dscl . list /Users | grep -v '_'</code> command can also be used to enumerate user accounts. Environment variables, such as <code>%USERNAME%</code> and <code>$USER</code>, may also be used to access this information.</p><p>On network devices, Network Device CLI commands such as
show users and show ssh can be used to display users currently logged into the device.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2024-4577 | PHP Group PHP | secondary impact | Mapped | 2024-06-12 |
| CVE-2023-22518 | Atlassian Confluence Data Center and Server | primary impact | Mapped | 2023-11-07 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0093 Behavioral Detection of User Discovery via Local and Remote Enumeration v1.0
AN0254 WindowsAdversary launches built-in system tools (e.g., whoami, query user, net user) or scripts that enumerate user account information via local execution or remote API queries (e.g., WMI, PowerShell).Tunable:
ParentProcessContextTimeWindowUserContextAN0255 LinuxAdversary runs commands likewhoami,id,w, orcat /etc/passwdfrom non-interactive or scripting contexts to enumerate system user details.Tunable:CommandLineRegexShellContextAccessFrequencyAN0256 macOSAdversary usesdscl,who, or environment variables like$USERto identify accounts or sessions via Terminal or malicious LaunchAgents.Tunable:LaunchAgentPersistenceCommandExecutionPathUsernameEnumerationPatternAN0257 Network DevicesAdversary executes CLI commands likeshow users,show ssh, or attempts to dump AAA user lists from routers or switches.Tunable:CLICommandBaselineDeviceRoleSensitivityCommandFrequencyThreshold
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1033
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-09-09 (modified 2022-11-17) · logsource: product=windows category=process_creation · 1114e048-b69c-4f41-bc20-657245ae6e3f
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file
Author: Cedric Maurugeon
· 2023-09-04 · logsource: product=linux category=process_creation · 33e814e0-1f00-4e43-9c34-31fb7ae2b174
Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.
Author: frack113
· 2022-04-04 · logsource: product=windows category=ps_script · 4096a49c-7de4-4da0-a230-c66ccd56ea5a
Detects the use of PowerShell to identify the current logged user.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-11-10 (modified 2022-11-17) · logsource: product=windows category=process_creation · 435e10e4-992a-4281-96f3-38b11106adde
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file
Author: Florian Roth (Nextron Systems)
· 2022-03-17 (modified 2023-11-09) · logsource: product=windows category=process_creation · 4ebc877f-4612-45cb-b3a5-8e3834db36c9
Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system
Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community
· 2019-10-21 (modified 2025-10-20) · logsource: product=windows category=process_creation · 502b42de-4306-40b4-9596-6f590c81f073
Local accounts, System Owner/User discovery using operating systems utilities
Author: Sagie Dulce, Dekel Paz
· 2022-01-01 · logsource: product=rpc_firewall category=application · 56fda488-113e-4ce9-8076-afc2457922c3
Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.
Author: Cedric Maurugeon
· 2023-09-04 · logsource: product=linux category=process_creation · 5f1573a7-363b-4114-9208-ad7a61de46eb
Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.
Author: Sagie Dulce, Dekel Paz
· 2022-01-01 · logsource: product=rpc_firewall category=application · 6d580420-ff3f-4e0e-b6b0-41b90c787e28
Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.
Author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov
· 2022-01-28 (modified 2023-12-04) · logsource: product=windows category=process_creation · 79ce34ca-af29-4d0e-b832-fc1b377020db
Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors
Author: Florian Roth (Nextron Systems)
· 2021-08-12 (modified 2025-03-06) · logsource: product=windows category=process_creation · 8de1cbe8-d6f5-496d-8237-5f44a721c7a0
Detects the execution of whoami.exe with suspicious parent processes.
Author: frack113
· 2022-03-17 · logsource: product=windows category=ps_script · 96c982fe-3d08-4df4-bed2-eb14e02f21c8
Detects AS-REP roasting is an attack that is often-overlooked. It is not very common as you have to explicitly set accounts that do not require pre-authentication.
Author: Austin Clark
· 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 9705a6a1-6db6-4a16-a987-15b7151e299b
Find information about network devices that is not stored in config files
Author: Florian Roth (Nextron Systems)
· 2021-05-05 (modified 2023-02-28) · logsource: product=windows category=process_creation · 97a80ec7-0e2f-4d05-9ef4-65760e634f6b
Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privileges. This is often used after a privilege escalation attempt.
Author: Timur Zinniatullin, oscd.community
· 2019-10-21 (modified 2025-06-04) · logsource: product=linux service=auditd · 9a0d8ca0-2385-4020-b6c6-cb6153ca56f3
Detects the execution of host or user discovery utilities such as "whoami", "hostname", "id", etc.
Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Author: frack113
· 2021-12-10 (modified 2023-02-14) · logsource: product=windows category=process_creation · b2317cfa-4a47-4ead-b3ff-297438c0bc2d
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-02-28 · logsource: product=windows category=process_creation · bd8b828d-0dca-48e1-8a63-8a58ecf2644f
Detects the execution of whoami.exe with the /group command line flag to show group membership for the current user, account type, security identifiers (SID), and attributes.
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson
· 2017-01-01 (modified 2026-07-14) · logsource: product=windows category=process_creation · bed2a484-9348-4143-8a8a-b801c979301c
Detects certain command line parameters often used during reconnaissance activity via web shells
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2023-12-04 (modified 2024-03-05) · logsource: product=windows category=process_creation · c248c896-e412-4279-8c15-1c558067b6fa
Detects the execution of "whoami.exe" with the "/all" flag
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-11-17 · logsource: product=windows category=ps_script · c2993223-6da8-4b1a-88ee-668b8bf315e9
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2023-02-28 (modified 2023-12-04) · logsource: product=windows category=process_creation · c30fb093-1109-4dc8-88a8-b30d11c95a5d
Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to export the results to a file for later use.
Author: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon
· 2023-09-04 · logsource: product=linux category=process_creation · d54c2f06-aca9-4e2b-81c9-5317858f4b79
Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.
Author: Florian Roth (Nextron Systems)
· 2022-08-29 (modified 2023-02-04) · logsource: product=windows category=process_creation · d9367cbb-c2e0-47ce-bdc0-128cb6da898d
Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-11-17 · logsource: product=windows category=ps_script · db885529-903f-4c5d-9864-28fe199e6370
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file
Author: Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems)
· 2019-01-10 (modified 2023-02-03) · logsource: product=windows category=process_creation · e6eb5a96-9e6f-4a18-9cdd-642cfda21c8e
Detects potential Dridex acitvity via specific process patterns
Author: Cedric Maurugeon
· 2023-09-04 · logsource: product=linux category=process_creation · e80273e1-9faf-40bc-bd85-dbaff104c4e9
Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.
Author: Florian Roth (Nextron Systems)
· 2021-11-29 (modified 2022-12-25) · logsource: product=windows category=process_creation · e9142d84-fbe0-401d-ac50-3e519fb00c89
Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)
Author: Florian Roth (Nextron Systems)
· 2021-08-12 (modified 2022-10-09) · logsource: product=windows category=process_creation · f1086bf7-a0c4-4a37-9102-01e573caf4a0
Detects the execution of whoami that has been renamed to a different name to avoid detection
Author: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon
· 2023-09-04 · logsource: product=linux category=process_creation · f41dada5-3f56-4232-8503-3fb7f9cf2d60
Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.
Author: Florian Roth (Nextron Systems), MSTI (query)
· 2022-10-01 · logsource: product=windows category=process_creation · fa3c117a-bc0d-416e-a31b-0c0e80653efb
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells