{"id":"502b42de-4306-40b4-9596-6f590c81f073","title":"Local Accounts Discovery","description":"Local accounts, System Owner/User discovery using operating systems utilities","author":"Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community","status":"test","level":"low","date":"2019-10-21","modified":"2025-10-20","tags":["attack.discovery","attack.t1033","attack.t1087.001"],"technique_ids":["T1033","T1087.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate administrator or user enumerates local users for legitimate reason"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_local_system_owner_account_discovery.yml","source_sha256":"ddb20029d804c7a434cc6600659aaac2b646b67cd150470e9b1ef4be47c16e06","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_local_system_owner_account_discovery.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Local Accounts Discovery\nid: 502b42de-4306-40b4-9596-6f590c81f073\nstatus: test\nrelated:\n    - id: e28a5a99-da44-436d-b7a0-2afc20a5f413 # Whoami Utility Execution\n      type: obsolete\ndescription: Local accounts, System Owner/User discovery using operating systems utilities\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md\nauthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community\ndate: 2019-10-21\nmodified: 2025-10-20\ntags:\n    - attack.discovery\n    - attack.t1033\n    - attack.t1087.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_other_img:\n        - Image|endswith:\n              - '\\whoami.exe'\n              - '\\quser.exe'\n              - '\\qwinsta.exe'\n        - OriginalFileName:\n              - 'whoami.exe'\n              - 'quser.exe'\n              - 'qwinsta.exe'\n    selection_other_wmi:\n        Image|endswith: '\\wmic.exe'\n        CommandLine|contains|all:\n            - 'useraccount'\n            - 'get'\n    selection_other_cmdkey:\n        Image|endswith: '\\cmdkey.exe'\n        CommandLine|contains: ' /l'\n    selection_cmd:\n        Image|endswith: '\\cmd.exe'\n        CommandLine|contains|all:\n            - ' /c'\n            - 'dir '\n            - '\\Users\\'\n    filter_cmd:\n        CommandLine|contains: ' rmdir ' # don't match on 'dir'   \"C:\\Windows\\System32\\cmd.exe\" /q /c rmdir /s /q \"C:\\Users\\XX\\AppData\\Local\\Microsoft\\OneDrive\\19.232.1124.0005\"\n    selection_net:\n        Image|endswith:\n            - '\\net.exe'\n            - '\\net1.exe'\n        CommandLine|contains: 'user'\n    filter_net:\n        CommandLine|contains:\n            - '/domain'       # local account discovery only\n            - '/add'          # discovery only\n            - '/delete'       # discovery only\n            - '/active'       # discovery only\n            - '/expires'      # discovery only\n            - '/passwordreq'  # discovery only\n            - '/scriptpath'   # discovery only\n            - '/times'        # discovery only\n            - '/workstations' # discovery only\n    condition: (selection_cmd and not filter_cmd) or (selection_net and not filter_net) or 1 of selection_other_*\nfalsepositives:\n    - Legitimate administrator or user enumerates local users for legitimate reason\nlevel: low\nsimulation:\n    - type: atomic-red-team\n      name: WMI Reconnaissance Users\n      technique: T1047\n      atomic_guid: c107778c-dcf5-47c5-af2e-1d058a3df3ea\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_susp_local_system_owner_account_discovery/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1033","id":"T1033","name":"System Owner/User Discovery","page":"techniques/enterprise/T1033/"},{"key":"enterprise/T1087.001","id":"T1087.001","name":"Local Account","page":"techniques/enterprise/T1087.001/"}],"data_path":"data/detection-rules/502b42de-4306-40b4-9596-6f590c81f073.json","kind":"sigma"}