Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Исследование владельца или пользователей системы

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping. The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Various utilities and commands may acquire this information, including whoami. In macOS and Linux, the currently logged in user can be identified with w and who. On macOS the dscl . list /Users | grep -v '_' command can also be used to enumerate user accounts. Environment variables, such as %USERNAME% and $USER, may also be used to access this information. On network devices, Network Device CLI commands such as `show users` and `show ssh` can be used to display users currently logged into the device.(Citation: show_ssh_users_cmd_cisco)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)

ID: T1033

Тактика(-и): Discovery

Платформы: Linux, Network Devices, Windows, macOS

Источники данных: Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access

Версия: 1.6

Дата создания: 31 May 2017

Последнее изменение: 15 Apr 2025

Название	Описание
Примеры процедур
TrickBot	TrickBot can identify the user and groups the user belongs to on a compromised host.(Citation: Cyberreason Anchor December 2019)
PowerDuke	PowerDuke has commands to get the current user's name and SID.(Citation: Volexity PowerDuke November 2016)
RCSession	RCSession can gather system owner information, including user and administrator privileges.(Citation: Profero APT27 December 2020)
Spark	Spark has run the whoami command and has a built-in command to identify the user logged in.(Citation: Unit42 Molerat Mar 2020)
SynAck	SynAck gathers user names from infected hosts.(Citation: SecureList SynAck Doppelgänging May 2018)
Bumblebee	Bumblebee has the ability to identify the user name.(Citation: Google EXOTIC LILY March 2022)
Amadey	Amadey has collected the user name from a compromised host using `GetUserNameA`.(Citation: BlackBerry Amadey 2020)
BloodHound	BloodHound can collect information on user sessions.(Citation: CrowdStrike BloodHound April 2018)
NOKKI	NOKKI can collect the username from the victim’s machine.(Citation: Unit 42 NOKKI Sept 2018)
yty	yty collects the victim’s username.(Citation: ASERT Donot March 2018)
Backdoor.Oldrea	Backdoor.Oldrea collects the current username from the victim.(Citation: Symantec Dragonfly)
Get2	Get2 has the ability to identify the current username of an infected host.(Citation: Proofpoint TA505 October 2019)
POWRUNER	POWRUNER may collect information about the currently logged in user by running `whoami` on a victim.(Citation: FireEye APT34 Dec 2017)
KOPILUWAK	KOPILUWAK can conduct basic network reconnaissance on the victim machine with `whoami`, to get user details.(Citation: Mandiant Suspected Turla Campaign February 2023)
Linux Rabbit	Linux Rabbit opens a socket on port 22 and if it receives a response it attempts to obtain the machine's hostname and Top-Level Domain. (Citation: Anomali Linux Rabbit 2018)
Exaramel for Linux	Exaramel for Linux can run `whoami` to identify the system owner.(Citation: ANSSI Sandworm January 2021)
SILENTTRINITY	SILENTTRINITY can gather a list of logged on users.(Citation: GitHub SILENTTRINITY Modules July 2019)
HAWKBALL	HAWKBALL can collect the user name of the system.(Citation: FireEye HAWKBALL Jun 2019)
RedLeaves	RedLeaves can obtain information about the logged on user both locally and for Remote Desktop sessions.(Citation: PWC Cloud Hopper Technical Annex April 2017)
Felismus	Felismus collects the current username and sends it to the C2 server.(Citation: Forcepoint Felismus Mar 2017)
GravityRAT	GravityRAT collects the victim username along with other account information (account type, description, full name, SID and status).(Citation: Talos GravityRAT)
HAPPYWORK	can collect the victim user name.(Citation: FireEye APT37 Feb 2018)
WinMM	WinMM uses NetUser-GetInfo to identify that it is running under an “Admin” account on the local system.(Citation: Baumgartner Naikon 2015)
PyDCrypt	PyDCrypt has probed victim machines with `whoami` and has collected the username from the machine.(Citation: Checkpoint MosesStaff Nov 2021)
SslMM	SslMM sends the logged-on username to its hard-coded C2.(Citation: Baumgartner Naikon 2015)
Aria-body	Aria-body has the ability to identify the username on a compromised host.(Citation: CheckPoint Naikon May 2020)
Emotet	Emotet has enumerated all users connected to network shares.
Crimson	Crimson can identify the user on a targeted system.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)
Empire	Empire can enumerate the username on targeted hosts.(Citation: Talos Frankenstein June 2019)
Turian	Turian can retrieve usernames.(Citation: ESET BackdoorDiplomacy Jun 2021)
BADHATCH	BADHATCH can obtain logged user information from a compromised machine and can execute the command `whoami.exe`.(Citation: BitDefender BADHATCH Mar 2021)
Action RAT	Action RAT has the ability to collect the username from an infected host.(Citation: MalwareBytes SideCopy Dec 2021)
Prikormka	A module in Prikormka collects information from the victim about the current user name.(Citation: ESET Operation Groundbait)
WellMess	WellMess can collect the username on the victim machine to send to C2.(Citation: CISA WellMess July 2020)
Woody RAT	Woody RAT can retrieve a list of user accounts and usernames from an infected machine.(Citation: MalwareBytes WoodyRAT Aug 2022)
Mafalda	Mafalda can collect the username from a compromised host.(Citation: SentinelLabs Metador Technical Appendix Sept 2022)
Squirrelwaffle	Squirrelwaffle can collect the user name from a compromised host.(Citation: ZScaler Squirrelwaffle Sep 2021)
AuTo Stealer	AuTo Stealer has the ability to collect the username from an infected host.(Citation: MalwareBytes SideCopy Dec 2021)
Agent.btz	Agent.btz obtains the victim username and saves it to a file.(Citation: ThreatExpert Agent.btz)
SombRAT	SombRAT can execute `getinfo` to identify the username on a compromised host.(Citation: BlackBerry CostaRicto November 2020)(Citation: CISA AR21-126A FIVEHANDS May 2021)
FlawedAmmyy	FlawedAmmyy enumerates the current user during the initial infection.(Citation: Proofpoint TA505 Mar 2018)(Citation: Korean FSI TA505 2020)
Rifdoor	Rifdoor has the ability to identify the username on the compromised host.(Citation: Carbon Black HotCroissant April 2020)
Cuckoo Stealer	Cuckoo Stealer can discover and send the username from a compromised host to C2.(Citation: Kandji Cuckoo April 2024)
InvisiMole	InvisiMole lists local users and session information.(Citation: ESET InvisiMole June 2018)
WINERACK	WINERACK can gather information on the victim username.(Citation: FireEye APT37 Feb 2018)
Okrum	Okrum can collect the victim username.(Citation: ESET Okrum July 2019)
Bonadan	Bonadan has discovered the username of the user running the backdoor.(Citation: ESET ForSSHe December 2018)
Neoichor	Neoichor can collect the user name from a victim's machine.(Citation: Microsoft NICKEL December 2021)
Raspberry Robin	Raspberry Robin determines whether it is successfully running on a victim system by querying the running account information to determine if it is running in Session 0, indicating running with elevated privileges.(Citation: TrendMicro RaspberryRobin 2022)
Diavol	Diavol can collect the username from a compromised host.(Citation: Fortinet Diavol July 2021)
BlackCat	BlackCat can utilize `net use` commands to discover the user name on a compromised host.(Citation: Microsoft BlackCat Jun 2022)
VERMIN	VERMIN gathers the username from the victim’s machine.(Citation: Unit 42 VERMIN Jan 2018)
Nightdoor	Nightdoor gathers information on victim system users and usernames.(Citation: ESET EvasivePanda 2024)
MarkiRAT	MarkiRAT can retrieve the victim’s username.(Citation: Kaspersky Ferocious Kitten Jun 2021)
PowerShower	PowerShower has the ability to identify the current user on the infected host.(Citation: Kaspersky Cloud Atlas August 2019)
Kazuar	Kazuar gathers information on users.(Citation: Unit 42 Kazuar May 2017)
DarkComet	DarkComet gathers the username from the victim’s machine.(Citation: TrendMicro DarkComet Sept 2014)
CHIMNEYSWEEP	CHIMNEYSWEEP has included the victim's computer name and username in C2 messages sent to actor-owned infrastructure.(Citation: Mandiant ROADSWEEP August 2022)
Lucifer	Lucifer has the ability to identify the username on a compromised host.(Citation: Unit 42 Lucifer June 2020)
zwShell	zwShell can obtain the name of the logged-in user on the victim.(Citation: McAfee Night Dragon)
DRATzarus	DRATzarus can obtain a list of users from an infected machine.(Citation: ClearSky Lazarus Aug 2020)
Rising Sun	Rising Sun can detect the username of the infected host.(Citation: McAfee Sharpshooter December 2018)
Chrommme	Chrommme can retrieve the username from a targeted system.(Citation: ESET Gelsemium June 2021)
ObliqueRAT	ObliqueRAT can check for blocklisted usernames on infected endpoints.(Citation: Talos Oblique RAT March 2021)
SocGholish	SocGholish can use `whoami` to obtain the username from a compromised host.(Citation: SocGholish-update)(Citation: Red Canary SocGholish March 2024)(Citation: Secureworks Gold Prelude Profile)
Flagpro	Flagpro has been used to run the `whoami` command on the system.(Citation: NTT Security Flagpro new December 2021)
XAgentOSX	XAgentOSX contains the getInfoOSX function to return the OS X version as well as the current user.(Citation: XAgentOSX 2017)
ROKRAT	ROKRAT can collect the username from a compromised host.(Citation: Malwarebytes RokRAT VBA January 2021)
DarkWatchman	DarkWatchman has collected the username from a victim machine.(Citation: Prevailion DarkWatchman 2021)
Dyre	Dyre has the ability to identify the users on a compromised host.(Citation: Malwarebytes Dyreza November 2015)
Reaver	Reaver collects the victim's username.(Citation: Palo Alto Reaver Nov 2017)
S-Type	S-Type has run tests to determine the privilege level of the compromised user.(Citation: Cylance Dust Storm)
Remsec	Remsec can obtain information about the current user.(Citation: Kaspersky ProjectSauron Technical Analysis)
Explosive	Explosive has collected the username from the infected host.(Citation: CheckPoint Volatile Cedar March 2015)
AsyncRAT	AsyncRAT can check if the current user of a compromised system is an administrator. (Citation: Telefonica Snip3 December 2021)
Epic	Epic collects the user name from the victim’s machine.(Citation: Kaspersky Turla Aug 2014)
Clambling	Clambling can identify the username on a compromised host.(Citation: Trend Micro DRBControl February 2020)(Citation: Talent-Jump Clambling February 2020)
Agent Tesla	Agent Tesla can collect the username from the victim’s machine.(Citation: DigiTrust Agent Tesla Jan 2017)(Citation: Fortinet Agent Tesla April 2018)(Citation: Malwarebytes Agent Tesla April 2020)
NanHaiShu	NanHaiShu collects the username from the victim.(Citation: fsecure NanHaiShu July 2016)
SVCReady	SVCReady can collect the username from an infected host.(Citation: HP SVCReady Jun 2022)
NGLite	NGLite will run the `whoami` command to gather system information and return this to the command and control server.(Citation: NGLite Trojan)
SHARPSTATS	SHARPSTATS has the ability to identify the username on the compromised host.(Citation: TrendMicro POWERSTATS V3 June 2019)
Caterpillar WebShell	Caterpillar WebShell can obtain a list of user accounts from a victim's machine.(Citation: ClearSky Lebanese Cedar Jan 2021)
Gazer	Gazer obtains the current user's security identifier.(Citation: Securelist WhiteBear Aug 2017)
Latrodectus	Latrodectus can discover the username of an infected host.(Citation: Elastic Latrodectus May 2024)
Saint Bot	Saint Bot can collect the username from a compromised host.(Citation: Malwarebytes Saint Bot April 2021)
Chaes	Chaes has collected the username and UID from the infected machine.(Citation: Cybereason Chaes Nov 2020)
EVILNUM	EVILNUM can obtain the username from the victim's machine.(Citation: Prevailion EvilNum May 2020)
SMOKEDHAM	SMOKEDHAM has used `whoami` commands to identify system owners.(Citation: FireEye SMOKEDHAM June 2021)
QUADAGENT	QUADAGENT gathers the victim username.(Citation: Unit 42 QUADAGENT July 2018)
Sys10	Sys10 collects the account name of the logged-in user and sends it to the C2.(Citation: Baumgartner Naikon 2015)
Metamorfo	Metamorfo has collected the username from the victim's machine.(Citation: ESET Casbaneiro Oct 2019)
Trojan.Karagany	Trojan.Karagany can gather information about the user on a compromised host.(Citation: Secureworks Karagany July 2019)
KONNI	KONNI can collect the username from the victim’s machine.(Citation: Talos Konni May 2017)
T9000	T9000 gathers and beacons the username of the logged in account during installation. It will also gather the username of running processes to determine if it is running as SYSTEM.(Citation: Palo Alto T9000 Feb 2016)
DnsSystem	DnsSystem can use the Windows user name to create a unique identification for infected users and systems.(Citation: Zscaler Lyceum DnsSystem June 2022)
BLUELIGHT	BLUELIGHT can collect the username on a compromised host.(Citation: Volexity InkySquid BLUELIGHT August 2021)
Ixeshe	Ixeshe collects the username from the victim’s machine.(Citation: Trend Micro IXESHE 2012)
Micropsia	Micropsia collects the username from the victim’s machine.(Citation: Talos Micropsia June 2017)
RogueRobin	RogueRobin collects the victim’s username and whether that user is an admin.(Citation: Unit 42 DarkHydrus July 2018)
LitePower	LitePower can determine if the current user has admin privileges.(Citation: Kaspersky WIRTE November 2021)
SDBbot	SDBbot has the ability to identify the user on a compromised host.(Citation: Proofpoint TA505 October 2019)
Mosquito	Mosquito runs `whoami` on the victim’s machine.(Citation: ESET Turla Mosquito Jan 2018)
RTM	RTM can obtain the victim username and permissions.(Citation: ESET RTM Feb 2017)
Derusbi	A Linux version of Derusbi checks if the victim user ID is anything other than zero (normally used for root), and the malware will not execute if it does not have root privileges. Derusbi also gathers the username of the victim.(Citation: Fidelis Turbo)
SodaMaster	SodaMaster can identify the username on a compromised host.(Citation: Securelist APT10 March 2021)
Grandoreiro	Grandoreiro can collect the username from the victim's machine.(Citation: ESET Grandoreiro April 2020)
WellMail	WellMail can identify the current username on the victim system.(Citation: CISA WellMail July 2020)
LiteDuke	LiteDuke can enumerate the account name on a targeted system.(Citation: ESET Dukes October 2019)
ZxxZ	ZxxZ can collect the username from a compromised host.(Citation: Cisco Talos Bitter Bangladesh May 2022)
WINDSHIELD	WINDSHIELD can gather the victim user name.(Citation: FireEye APT32 May 2017)
Bazar	Bazar can identify the username of the infected user.(Citation: NCC Group Team9 June 2020)
RATANKBA	RATANKBA runs the `whoami` and `query user` commands.(Citation: RATANKBA)
XLoader	XLoader can identify the username from a victim machine.(Citation: Acronis XLoader 2021)
MoonWind	MoonWind obtains the victim username.(Citation: Palo Alto MoonWind March 2017)
Cryptoistic	Cryptoistic can gather data on the user of a compromised host.(Citation: SentinelOne Lazarus macOS July 2020)
MgBot	MgBot includes modules for identifying local users and administrators on victim machines.(Citation: Symantec Daggerfly 2023)
Zebrocy	Zebrocy gets the username from the system.(Citation: ESET Zebrocy Nov 2018)(Citation: CISA Zebrocy Oct 2020)
SpeakUp	SpeakUp uses the `whoami` command. (Citation: CheckPoint SpeakUp Feb 2019)
SUNBURST	SUNBURST collected the username from a compromised host.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Microsoft Analyzing Solorigate Dec 2020)
HotCroissant	HotCroissant has the ability to collect the username on the infected host.(Citation: Carbon Black HotCroissant April 2020)
ServHelper	ServHelper will attempt to enumerate the username of the victim.(Citation: Proofpoint TA505 Jan 2019)
Unknown Logger	Unknown Logger can obtain information about the victim usernames.(Citation: Forcepoint Monsoon)
Valak	Valak can gather information regarding the user.(Citation: Cybereason Valak May 2020)
Milan	Milan can identify users registered to a targeted machine.(Citation: ClearSky Siamesekitten August 2021)
OilBooster	OilBooster can identify the compromised system's username which is then used as part of a unique identifier.(Citation: ESET OilRig Downloaders DEC 2023)
Raccoon Stealer	Raccoon Stealer gathers information on the infected system owner and user.(Citation: S2W Racoon 2022)(Citation: Sekoia Raccoon1 2022)(Citation: Sekoia Raccoon2 2022)
NBTscan	NBTscan can list active users on the system.(Citation: Debian nbtscan Nov 2019)(Citation: SecTools nbtscan June 2003)
Cardinal RAT	Cardinal RAT can collect the username from a victim machine.(Citation: PaloAlto CardinalRat Apr 2017)
BISCUIT	BISCUIT has a command to gather the username from the system.(Citation: Mandiant APT1 Appendix)
Gold Dragon	Gold Dragon collects the endpoint victim's username and uses it as a basis for downloading additional components from the C2 server.(Citation: McAfee Gold Dragon)
RGDoor	RGDoor executes the `whoami` on the victim’s machine.(Citation: Unit 42 RGDoor Jan 2018)
Revenge RAT	Revenge RAT gathers the username from the system.(Citation: Cylance Shaheen Nov 2018)
MacMa	MacMa can collect the username from the compromised machine.(Citation: ESET DazzleSpy Jan 2022)
FunnyDream	FunnyDream has the ability to gather user information from the targeted system using `whoami/upn&whoami/fqdn&whoami/logonid&whoami/all`.(Citation: Bitdefender FunnyDream Campaign November 2020)
More_eggs	More_eggs has the capability to gather the username from the victim's machine.(Citation: Talos Cobalt Group July 2018)(Citation: Security Intelligence More Eggs Aug 2019)
SysUpdate	SysUpdate can collect the username from a compromised host.(Citation: Lunghi Iron Tiger Linux)
Kwampirs	Kwampirs collects registered owner details by using the commands `systeminfo` and `net config workstation`.(Citation: Symantec Orangeworm April 2018)
BoomBox	BoomBox can enumerate the username on a compromised host.(Citation: MSTIC Nobelium Toolset May 2021)
Mango	Mango can collect the user name from a compromised system which is used to create a unique victim identifier.(Citation: ESET OilRig Campaigns Sep 2023)
Koadic	Koadic can identify logged in users across the domain and views user sessions.(Citation: Github Koadic)(Citation: MalwareBytes LazyScripter Feb 2021)
GrimAgent	GrimAgent can identify the user id on a target machine.(Citation: Group IB GrimAgent July 2021)
Pupy	Pupy can enumerate local information for Linux hosts and find currently logged on users for Windows hosts.(Citation: GitHub Pupy)
Lokibot	Lokibot has the ability to discover the username on the infected host.(Citation: FSecure Lokibot November 2019)
Egregor	Egregor has used tools to gather information about users.(Citation: Intrinsec Egregor Nov 2020)
PoetRAT	PoetRAT sent username, computer name, and the previously generated UUID in reply to a "who" command from C2.(Citation: Talos PoetRAT April 2020)
FELIXROOT	FELIXROOT collects the username from the victim’s machine.(Citation: FireEye FELIXROOT July 2018)(Citation: ESET GreyEnergy Oct 2018)
ZxShell	ZxShell can collect the owner and organization information from the target workstation.(Citation: Talos ZxShell Oct 2014)
NDiskMonitor	NDiskMonitor obtains the victim username and encrypts the information to send over its C2 channel.(Citation: TrendMicro Patchwork Dec 2017)
BabyShark	BabyShark has executed the `whoami` command.(Citation: Unit42 BabyShark Feb 2019)
Cannon	Cannon can gather the username from the system.(Citation: Unit42 Cannon Nov 2018)
CreepySnail	CreepySnail can execute `getUsername` on compromised systems.(Citation: Microsoft POLONIUM June 2022)
njRAT	njRAT enumerates the current user during the initial infection.(Citation: Fidelis njRAT June 2013)
QuasarRAT	QuasarRAT can enumerate the username and account type.(Citation: CISA AR18-352A Quasar RAT December 2018)
POWERSTATS	POWERSTATS has the ability to identify the username on the compromised host.(Citation: TrendMicro POWERSTATS V3 June 2019)
JPIN	JPIN can obtain the victim user name.(Citation: Microsoft PLATINUM April 2016)
metaMain	metaMain can collect the username from a compromised host.(Citation: SentinelLabs Metador Technical Appendix Sept 2022)
SideTwist	SideTwist can collect the username on a targeted system.(Citation: Check Point APT34 April 2021)
MechaFlounder	MechaFlounder has the ability to identify the username and hostname on a compromised host.(Citation: Unit 42 MechaFlounder March 2019)
Mis-Type	Mis-Type runs tests to determine the privilege level of the compromised user.(Citation: Cylance Dust Storm)
LunarWeb	LunarWeb can collect user information from the targeted host.(Citation: ESET Turla Lunar toolset May 2024)
Octopus	Octopus can collect the username from the victim’s machine.(Citation: Securelist Octopus Oct 2018)
STARWHALE	STARWHALE can gather the username from an infected host.(Citation: Mandiant UNC3313 Feb 2022)(Citation: DHS CISA AA22-055A MuddyWater February 2022)
MirageFox	MirageFox can gather the username from the victim’s machine.(Citation: APT15 Intezer June 2018)
DownPaper	DownPaper collects the victim username and sends it to the C2 server.(Citation: ClearSky Charming Kitten Dec 2017)
Goopy	Goopy has the ability to enumerate the infected system's user name.(Citation: Cybereason Cobalt Kitty 2017)
ShadowPad	ShadowPad has collected the username of the victim system.(Citation: Kaspersky ShadowPad Aug 2017)
QakBot	QakBot can identify the user name on a compromised system.(Citation: Kaspersky QakBot September 2021)(Citation: Trend Micro Black Basta October 2022)
Gelsemium	Gelsemium has the ability to distinguish between a standard user and an administrator on a compromised host.(Citation: ESET Gelsemium June 2021)
Komplex	The OsInfo function in Komplex collects the current running username.(Citation: Sofacy Komplex Trojan)
Denis	Denis enumerates and collects the username from the victim’s machine.(Citation: Securelist Denis April 2017)(Citation: Cybereason Cobalt Kitty 2017)
Lizar	Lizar can collect the username from the system.(Citation: BiZone Lizar May 2021)
Azorult	Azorult can collect the username from the victim’s machine.(Citation: Unit42 Azorult Nov 2018)
UPPERCUT	UPPERCUT has the capability to collect the current logged on user’s username from a machine.(Citation: FireEye APT10 Sept 2018)
StrifeWater	StrifeWater can collect the user name from the victim's machine.(Citation: Cybereason StrifeWater Feb 2022)
SLOTHFULMEDIA	SLOTHFULMEDIA has collected the username from a victim machine.(Citation: CISA MAR SLOTHFULMEDIA October 2020)
Small Sieve	Small Sieve can obtain the id of a logged in user.(Citation: NCSC GCHQ Small Sieve Jan 2022)
Frankenstein	Frankenstein has enumerated hosts, gathering username, machine name, and administrative permissions information.(Citation: Talos Frankenstein June 2019)
Tropic Trooper	Tropic Trooper used `letmein` to scan for saved usernames on the target system.(Citation: TrendMicro TropicTrooper 2015)
Operation Wocao	Operation Wocao has enumerated sessions and users on a remote host, and identified privileged users logged into a targeted system.(Citation: FoxIT Wocao December 2019)
Lazarus Group	Various Lazarus Group malware enumerates logged-on users.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)(Citation: Novetta Blockbuster Loaders)(Citation: Novetta Blockbuster RATs)(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: SentinelOne Lazarus macOS July 2020)(Citation: Lazarus APT January 2022)
Gamaredon Group	A Gamaredon Group file stealer can gather the victim's username to send to a C2 server.(Citation: Palo Alto Gamaredon Feb 2017)
APT39	APT39 used Remexi to collect usernames from the system.(Citation: Symantec Chafer Dec 2015)
APT38	APT38 has identified primary users, currently logged in users, sets of users that commonly use a system, or inactive users.(Citation: CISA AA20-239A BeagleBoyz August 2020)
MuddyWater	MuddyWater has used malware that can collect the victim’s username.(Citation: Securelist MuddyWater Oct 2018)(Citation: Trend Micro Muddy Water March 2021)
Dragonfly 2.0	Dragonfly 2.0 used the command `query user` on victim hosts.(Citation: US-CERT TA18-074A)
Aquatic Panda	Aquatic Panda gathers information on recently logged-in users on victim devices.(Citation: Crowdstrike HuntReport 2022)
ZIRCONIUM	ZIRCONIUM has used a tool to capture the username on a compromised host in order to register it with C2.(Citation: Zscaler APT31 Covid-19 October 2020)
Wizard Spider	Wizard Spider has used "whoami" to identify the local user and their privileges.(Citation: Sophos New Ryuk Attack October 2020)
Threat Group-3390	Threat Group-3390 has used `whoami` to collect system user information.(Citation: Trend Micro DRBControl February 2020)
APT32	APT32 collected the victim's username and executed the `whoami` command on the victim's machine. APT32 executed shellcode to collect the username on the victim's machine. (Citation: FireEye APT32 April 2020)(Citation: ESET OceanLotus)(Citation: Cybereason Cobalt Kitty 2017)
Dragonfly	Dragonfly used the command `query user` on victim hosts.(Citation: US-CERT TA18-074A)
Sidewinder	Sidewinder has used tools to identify the user of a compromised host.(Citation: ATT Sidewinder January 2021)
OilRig	OilRig has run `whoami` on a victim.(Citation: Palo Alto OilRig May 2016)(Citation: Palo Alto OilRig Oct 2016)(Citation: Check Point APT34 April 2021)
LuminousMoth	LuminousMoth has used a malicious DLL to collect the username from compromised hosts.(Citation: Bitdefender LuminousMoth July 2021)
APT19	APT19 used an HTTP malware variant and a Port 22 malware variant to collect the victim’s username.(Citation: Unit 42 C0d0so0 Jan 2016)
APT37	APT37 identifies the victim username.(Citation: Talos Group123)
Chimera	Chimera has used the `quser` command to show currently logged on users.(Citation: NCC Group Chimera January 2021)
HEXANE	HEXANE has run `whoami` on compromised machines to identify the current user.(Citation: Kaspersky Lyceum October 2021)
FIN7	FIN7 has used the command `cmd.exe /C quser` to collect user session information.(Citation: Mandiant FIN7 Apr 2022)
Volt Typhoon	Volt Typhoon has used public tools and executed the PowerShell command `Get-EventLog security -instanceid 4624` to identify associated user and computer account names.(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)(Citation: Secureworks BRONZE SILHOUETTE May 2023)(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)
Sandworm Team	Sandworm Team has collected the username from a compromised host.(Citation: US District Court Indictment GRU Unit 74455 October 2020)
Magic Hound	Magic Hound malware has obtained the victim username and sent it to the C2 server.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)
Ke3chang	Ke3chang has used implants capable of collecting the signed-in username.(Citation: Microsoft NICKEL December 2021)
Windshift	Windshift has used malware to identify the username on a compromised host.(Citation: BlackBerry Bahamut)
Storm-1811	Storm-1811 has used `whoami.exe` to determine if the active user on a compromised system is an administrator.(Citation: rapid7-email-bombing)
Patchwork	Patchwork collected the victim username and whether it was running as admin, then sent the information to its C2 server.(Citation: Cymmetria Patchwork)(Citation: TrendMicro Patchwork Dec 2017)
Moonstone Sleet	Moonstone Sleet deployed various malware such as YouieLoader that can perform system user discovery actions.(Citation: Microsoft Moonstone Sleet 2024)
FIN10	FIN10 has used Meterpreter to enumerate users on remote systems.(Citation: FireEye FIN10 June 2017)
APT3	An APT3 downloader uses the Windows command `"cmd.exe" /C whoami` to verify that it is running with the elevated privileges of “System.”(Citation: FireEye Operation Double Tap)
Winter Vivern	Winter Vivern PowerShell scripts execute `whoami` to identify the executing user.(Citation: SentinelOne WinterVivern 2023)
GALLIUM	GALLIUM used `whoami` and `query user` to obtain information about the victim user.(Citation: Cybereason Soft Cell June 2019)
Earth Lusca	Earth Lusca collected information on user accounts via the `whoami` command.(Citation: TrendMicro EarthLusca 2022)
APT41	APT41 has executed `whoami` commands, including using the WMIEXEC utility to execute this on remote machines.(Citation: FireEye APT41 Aug 2019)(Citation: Rostovcev APT41 2021)
FIN8	FIN8 has executed the command `quser` to display the session details of a compromised machine.(Citation: Symantec FIN8 Jul 2023)
HAFNIUM	HAFNIUM has used `whoami` to gather user information.(Citation: Rapid7 HAFNIUM Mar 2021)
Stealth Falcon	Stealth Falcon malware gathers the registered user and primary owner name via WMI.(Citation: Citizen Lab Stealth Falcon May 2016)

Контрмера	Описание
Контрмеры
System Owner/User Discovery Mitigation	Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about system users, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

Обнаружение

`System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell. For network infrastructure devices, collect AAA logging to monitor `show` commands being run by non-standard users from non-standard locations.

Исследование владельца или пользователей системы

Примеры процедур

Контрмеры

Обнаружение

Ссылки