CmdID

CmdID / Commands

id

Print user and group ID. toybox

On Linux 3 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Linux

from the toybox, 0BSD

Print user and group ID. !-Z Show only security context

id [-Ggnru!Z] [USER...]
-GShow all group IDs
-gShow only the effective group ID
-nPrint names instead of numeric IDs (to be used with -Ggu)
-rShow real ID instead of effective ID
-uShow only the effective user ID

Several platforms

from tldr-pages, CC BY 4.0

Display current user and group identity.

Display current user's ID (UID), group ID (GID), and groups to which they belong

Trips 2 Sigma rules: lowLocal System Accounts Discovery - MacOs by Alejandro Ortuno, oscd.community; lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad

Display the current user identity

id --user --nameIdentify

Trips 2 Sigma rules: lowLocal System Accounts Discovery - MacOs by Alejandro Ortuno, oscd.community; lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad

Display the current user identity as a number

id --userIdentify

Trips 2 Sigma rules: lowLocal System Accounts Discovery - MacOs by Alejandro Ortuno, oscd.community; lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad

Display the current primary group identity

id --group --nameIdentify

Trips 2 Sigma rules: lowLocal System Accounts Discovery - MacOs by Alejandro Ortuno, oscd.community; lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad

Display the current primary group identity as a number

id --groupIdentify

Trips 2 Sigma rules: lowLocal System Accounts Discovery - MacOs by Alejandro Ortuno, oscd.community; lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad

Display all groups the current user belongs to

id --groups --nameIdentify

Trips 2 Sigma rules: lowLocal System Accounts Discovery - MacOs by Alejandro Ortuno, oscd.community; lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad

Display an arbitrary user's ID (UID), group ID (GID), and groups to which they belong

id usernameIdentify

Trips 2 Sigma rules: lowLocal System Accounts Discovery - MacOs by Alejandro Ortuno, oscd.community; lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad

Skip name lookup and specify the UID number explicitly

id +uid_numberIdentify

Trips 2 Sigma rules: lowLocal System Accounts Discovery - MacOs by Alejandro Ortuno, oscd.community; lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad

What detects it

Sigma process creation rules that name id
highLinux Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
lowLocal System Accounts Discovery - MacOsAlejandro Ortuno, oscd.community
lowLocal System Accounts Discovery Attempt - LinuxAlejandro Ortuno, oscd.community, CheraghiMilad