CmdID

CmdID / Commands

users

Display a list of logged in users. tldr-pages

On several platforms 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Several platforms

from tldr-pages, CC BY 4.0

Print logged in usernames

Trips 2 Sigma rules: lowLocal System Accounts Discovery - MacOs by Alejandro Ortuno, oscd.community; lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad

Print logged in usernames according to a given file

users /var/log/wmtpIdentify

Trips 2 Sigma rules: lowLocal System Accounts Discovery - MacOs by Alejandro Ortuno, oscd.community; lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad

What detects it

Sigma process creation rules that name users
lowLocal System Accounts Discovery - MacOsAlejandro Ortuno, oscd.community
lowLocal System Accounts Discovery Attempt - LinuxAlejandro Ortuno, oscd.community, CheraghiMilad