MITRE ATT&CK technique

System Owner/User Discovery detection rulesT1033

System Owner/User Discovery (T1033) is a MITRE ATT&CK technique in the Discovery tactic. This page lists the 30 community-maintained Sigma detection rules in the library mapped to T1033 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows, linux, rpc_firewall.

T1033 on attack.mitre.org30 rules

Tactic

Discovery

Potential Dridex Activity
critical
Detects potential Dridex acitvity via specific process patterns
windows · process_creation
Renamed Whoami Execution
critical
Detects the execution of whoami that has been renamed to a different name to avoid detection
windows · process_creation
Chopper Webshell Process Pattern
high
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells
windows · process_creation
HackTool - SharpLdapWhoami Execution
high
Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller
windows · process_creation
HackTool - SharpView Execution
high
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
windows · process_creation
Possible DCSync Attack
high
Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.
rpc_firewall · application
Security Privileges Enumeration Via Whoami.EXE
high
Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privileges. This is often used after a privilege escalation attempt.
windows · process_creation
SharpHound Recon Sessions
high
Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.
rpc_firewall · application
Webshell Detection With Command Line Keywords
high
Detects certain command line parameters often used during reconnaissance activity via web shells
windows · process_creation
Webshell Hacking Activity Patterns
high
Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system
windows · process_creation
WhoAmI as Parameter
high
Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)
windows · process_creation
Whoami.EXE Execution From Privileged Process
high
Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors
windows · process_creation
Computer Discovery And Export Via Get-ADComputer Cmdlet
medium
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file
windows · process_creation
Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell
medium
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file
windows · ps_script
Enumerate All Information With Whoami.EXE
medium
Detects the execution of "whoami.exe" with the "/all" flag
windows · process_creation
ESXi Network Configuration Discovery Via ESXCLI
medium
Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.
linux · process_creation
ESXi Storage Information Discovery Via ESXCLI
medium
Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.
linux · process_creation
ESXi System Information Discovery Via ESXCLI
medium
Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.
linux · process_creation
ESXi VM List Discovery Via ESXCLI
medium
Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.
linux · process_creation
ESXi VSAN Information Discovery Via ESXCLI
medium
Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.
linux · process_creation
Get-ADUser Enumeration Using UserAccountControl Flags
medium
Detects AS-REP roasting is an attack that is often-overlooked. It is not very common as you have to explicitly set accounts that do not require pre-authentication.
windows · ps_script
Group Membership Reconnaissance Via Whoami.EXE
medium
Detects the execution of whoami.exe with the /group command line flag to show group membership for the current user, account type, security identifiers (SID), and attributes.
windows · process_creation
User Discovery And Export Via Get-ADUser Cmdlet
medium
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file
windows · process_creation
User Discovery And Export Via Get-ADUser Cmdlet - PowerShell
medium
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file
windows · ps_script
Whoami.EXE Execution Anomaly
medium
Detects the execution of whoami.exe with suspicious parent processes.
windows · process_creation
Whoami.EXE Execution With Output Option
medium
Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to export the results to a file for later use.
windows · process_creation
Cisco Discovery
low
Find information about network devices that is not stored in config files
cisco
Local Accounts Discovery
low
Local accounts, System Owner/User discovery using operating systems utilities
windows · process_creation
Suspicious PowerShell Get Current User
low
Detects the use of PowerShell to identify the current logged user.
windows · ps_script
System Owner or User Discovery - Linux
low
Detects the execution of host or user discovery utilities such as "whoami", "hostname", "id", etc. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
linux

Top products

Tactic

Potential Dridex Activity

Renamed Whoami Execution

Chopper Webshell Process Pattern

HackTool - SharpLdapWhoami Execution

HackTool - SharpView Execution

Possible DCSync Attack

Security Privileges Enumeration Via Whoami.EXE

SharpHound Recon Sessions

Webshell Detection With Command Line Keywords

Webshell Hacking Activity Patterns

WhoAmI as Parameter

Whoami.EXE Execution From Privileged Process

Computer Discovery And Export Via Get-ADComputer Cmdlet

Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell

Enumerate All Information With Whoami.EXE

ESXi Network Configuration Discovery Via ESXCLI

ESXi Storage Information Discovery Via ESXCLI

ESXi System Information Discovery Via ESXCLI

ESXi VM List Discovery Via ESXCLI

ESXi VSAN Information Discovery Via ESXCLI

Get-ADUser Enumeration Using UserAccountControl Flags

Group Membership Reconnaissance Via Whoami.EXE

User Discovery And Export Via Get-ADUser Cmdlet

User Discovery And Export Via Get-ADUser Cmdlet - PowerShell

Whoami.EXE Execution Anomaly

Whoami.EXE Execution With Output Option

Cisco Discovery

Local Accounts Discovery

Suspicious PowerShell Get Current User

System Owner or User Discovery - Linux