T1033 System Owner/User Discovery

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. MITRE ATT&CK

22 Sigma rules T1033 on attack.mitre.org

Sigma rules tagged with it

process creation, the highest levels first

criticalPotential Dridex ActivityFlorian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems) · Windows

criticalRenamed Whoami ExecutionFlorian Roth (Nextron Systems) · Windows

highChopper Webshell Process PatternFlorian Roth (Nextron Systems), MSTI (query) · Windows

highHackTool - SharpLdapWhoami ExecutionFlorian Roth (Nextron Systems) · Windows

highHackTool - SharpView Executionfrack113 · Windows

highSecurity Privileges Enumeration Via Whoami.EXEFlorian Roth (Nextron Systems) · Windows

highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson · Windows

highWebshell Hacking Activity PatternsFlorian Roth (Nextron Systems) · Windows

highWhoAmI as ParameterFlorian Roth (Nextron Systems) · Windows

highWhoami.EXE Execution From Privileged ProcessFlorian Roth (Nextron Systems), Teymur Kheirkhabarov · Windows

mediumComputer Discovery And Export Via Get-ADComputer CmdletNasreddine Bencherchali (Nextron Systems) · Windows

mediumEnumerate All Information With Whoami.EXEFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows

mediumESXi Network Configuration Discovery Via ESXCLICedric Maurugeon · Linux

mediumESXi Storage Information Discovery Via ESXCLINasreddine Bencherchali (Nextron Systems), Cedric Maurugeon · Linux

mediumESXi System Information Discovery Via ESXCLICedric Maurugeon · Linux

mediumESXi VM List Discovery Via ESXCLICedric Maurugeon · Linux

mediumESXi VSAN Information Discovery Via ESXCLINasreddine Bencherchali (Nextron Systems), Cedric Maurugeon · Linux

mediumGroup Membership Reconnaissance Via Whoami.EXENasreddine Bencherchali (Nextron Systems) · Windows

mediumUser Discovery And Export Via Get-ADUser CmdletNasreddine Bencherchali (Nextron Systems) · Windows

mediumWhoami.EXE Execution AnomalyFlorian Roth (Nextron Systems) · Windows

mediumWhoami.EXE Execution With Output OptionFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows

lowLocal Accounts DiscoveryTimur Zinniatullin, Daniil Yugoslavskiy, oscd.community · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Make sure an SMB share is available in the current console on the page for net

net use \\smb_shared_folder /USER:usernameIdentify

To display a list of all user accounts for the local computer, run the following command on the page for net user

net userIdentify

To display information about the user account TommyH, run the following command on the page for net user

net user tommyhIdentify

To set the sign-in time from 8 AM to 5 PM for the username MikeD using 24-hour notation, run the following command on the page for net user

net user miked /time:M-F,08:00-17:00Identify

To set the sign-in time from 8 AM to 5 PM for MikeD using 12-hour notation, run the following command on the page for net user

net user miked /time:M-F,8AM-5PMIdentify

To specify sign-in hours of 4 AM to 12 PM on Monday, 12 PM to 8 PM on Tuesday, and 8 AM to 5 PM Wednesday through Friday for username AnibalS, run the following command on the page for net user

net user anibals /time:M,4AM-12PM;T,12PM-8PM;W-F,8AM-5PMIdentify

To display the domain and user name of the person who is currently logged on to this computer, type on the page for whoami

whoamiIdentify

To display all of the information in the current access token, type on the page for whoami

whoami /allIdentify

Display the groups that the current user is a member of on the page for whoami

whoami /groupsIdentify

Display the privileges of the current user on the page for whoami

whoami /privIdentify

Display the user principal name (UPN) of the current user on the page for whoami

whoami /upnIdentify

Display the logon ID of the current user on the page for whoami

whoami /logonidIdentify

An example is here when CmdID’s reading of it names T1033: a Sigma rule it trips is tagged with it, or its abuse is documented as it.