{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1033","id":"T1033","name":"System Owner/User Discovery","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1033","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"d218fa1ead263e02f4bde5ee99baa5bc58302ed09b3af35f647a528e444c8820","description":"Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nVarious utilities and commands may acquire this information, including <code>whoami</code>. In macOS and Linux, the currently logged in user can be identified with <code>w</code> and <code>who</code>. On macOS the <code>dscl . list /Users | grep -v '_'</code> command can also be used to enumerate user accounts. Environment variables, such as <code>%USERNAME%</code> and <code>$USER</code>, may also be used to access this information.\n\nOn network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show users` and `show ssh` can be used to display users currently logged into the device.(Citation: show_ssh_users_cmd_cisco)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1033","external_id":"T1033"},{"source_name":"show_ssh_users_cmd_cisco","description":"Cisco. (2023, March 7). Cisco IOS Security Command Reference: Commands S to Z . Retrieved July 13, 2022.","url":"https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/s1/sec-s1-cr-book/sec-cr-s5.html"},{"source_name":"US-CERT TA18-106A Network Infrastructure Devices 2018","description":"US-CERT. (2018, April 20). Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.","url":"https://us-cert.cisa.gov/ncas/alerts/TA18-106A"}],"platforms":["Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0021","name":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component","category":"Application and service audit","description":"Instrumented operating-system API calls and their return values.","collection_focus":"Use an approved EDR trace or instrument the owned lab process at selected APIs. Define API name, caller, sanitized arguments and return status.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["process_id","api","path","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1033","id":"T1033","name":"System Owner/User Discovery","domain":"enterprise","platforms":["Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"source_url":"https://attack.mitre.org/techniques/T1033","technique_page":"techniques/enterprise/T1033/","page":"detections/enterprise/T1033/","status":"rule_source_available","counts":{"sigma":29,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[{"id":"56fda488-113e-4ce9-8076-afc2457922c3","title":"Possible DCSync Attack","status":"test","level":"high","logsource":{"product":"rpc_firewall","category":"application","definition":"Requirements: install and apply the RPC Firewall to all processes, enable DRSR UUID (e3514235-4b06-11d1-ab04-00c04fc2dcd2) for \"dangerous\" opcodes (not 0,1 or 12) only from trusted IPs (DCs)"},"data_path":"data/detection-rules/56fda488-113e-4ce9-8076-afc2457922c3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/rpc_firewall/rpc_firewall_dcsync_attack.yml","author":"Sagie Dulce, Dekel Paz","kind":"sigma"},{"id":"6d580420-ff3f-4e0e-b6b0-41b90c787e28","title":"SharpHound Recon Sessions","status":"test","level":"high","logsource":{"product":"rpc_firewall","category":"application","definition":"Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:4b324fc8-1670-01d3-1278-5a47bf6ee188 opnum:12"},"data_path":"data/detection-rules/6d580420-ff3f-4e0e-b6b0-41b90c787e28.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/rpc_firewall/rpc_firewall_sharphound_recon_sessions.yml","author":"Sagie Dulce, Dekel Paz","kind":"sigma"},{"id":"9a0d8ca0-2385-4020-b6c6-cb6153ca56f3","title":"System Owner or User Discovery - Linux","status":"test","level":"low","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/9a0d8ca0-2385-4020-b6c6-cb6153ca56f3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/execve/lnx_auditd_user_discovery.yml","author":"Timur Zinniatullin, oscd.community","kind":"sigma"},{"id":"33e814e0-1f00-4e43-9c34-31fb7ae2b174","title":"ESXi Network Configuration Discovery Via ESXCLI","status":"test","level":"medium","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/33e814e0-1f00-4e43-9c34-31fb7ae2b174.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_esxcli_network_discovery.yml","author":"Cedric Maurugeon","kind":"sigma"},{"id":"f41dada5-3f56-4232-8503-3fb7f9cf2d60","title":"ESXi Storage Information Discovery Via ESXCLI","status":"test","level":"medium","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/f41dada5-3f56-4232-8503-3fb7f9cf2d60.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_esxcli_storage_discovery.yml","author":"Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon","kind":"sigma"},{"id":"e80273e1-9faf-40bc-bd85-dbaff104c4e9","title":"ESXi System Information Discovery Via ESXCLI","status":"test","level":"medium","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/e80273e1-9faf-40bc-bd85-dbaff104c4e9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_esxcli_system_discovery.yml","author":"Cedric Maurugeon","kind":"sigma"},{"id":"5f1573a7-363b-4114-9208-ad7a61de46eb","title":"ESXi VM List Discovery Via ESXCLI","status":"test","level":"medium","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/5f1573a7-363b-4114-9208-ad7a61de46eb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_esxcli_vm_discovery.yml","author":"Cedric Maurugeon","kind":"sigma"},{"id":"d54c2f06-aca9-4e2b-81c9-5317858f4b79","title":"ESXi VSAN Information Discovery Via ESXCLI","status":"test","level":"medium","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/d54c2f06-aca9-4e2b-81c9-5317858f4b79.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_esxcli_vsan_discovery.yml","author":"Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon","kind":"sigma"},{"id":"9705a6a1-6db6-4a16-a987-15b7151e299b","title":"Cisco Discovery","status":"test","level":"low","logsource":{"product":"cisco","service":"aaa"},"data_path":"data/detection-rules/9705a6a1-6db6-4a16-a987-15b7151e299b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/aaa/cisco_cli_discovery.yml","author":"Austin Clark","kind":"sigma"},{"id":"96c982fe-3d08-4df4-bed2-eb14e02f21c8","title":"Get-ADUser Enumeration Using UserAccountControl Flags","status":"test","level":"medium","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/96c982fe-3d08-4df4-bed2-eb14e02f21c8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_as_rep_roasting.yml","author":"frack113","kind":"sigma"},{"id":"db885529-903f-4c5d-9864-28fe199e6370","title":"Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell","status":"test","level":"medium","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/db885529-903f-4c5d-9864-28fe199e6370.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_computer_discovery_get_adcomputer.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"4096a49c-7de4-4da0-a230-c66ccd56ea5a","title":"Suspicious PowerShell Get Current User","status":"test","level":"low","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/4096a49c-7de4-4da0-a230-c66ccd56ea5a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_susp_get_current_user.yml","author":"frack113","kind":"sigma"},{"id":"c2993223-6da8-4b1a-88ee-668b8bf315e9","title":"User Discovery And Export Via Get-ADUser Cmdlet - PowerShell","status":"test","level":"medium","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/c2993223-6da8-4b1a-88ee-668b8bf315e9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_user_discovery_get_aduser.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"d9367cbb-c2e0-47ce-bdc0-128cb6da898d","title":"HackTool - SharpLdapWhoami Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/d9367cbb-c2e0-47ce-bdc0-128cb6da898d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_sharpldapwhoami.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"b2317cfa-4a47-4ead-b3ff-297438c0bc2d","title":"HackTool - SharpView Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b2317cfa-4a47-4ead-b3ff-297438c0bc2d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_sharpview.yml","author":"frack113","kind":"sigma"},{"id":"435e10e4-992a-4281-96f3-38b11106adde","title":"Computer Discovery And Export Via Get-ADComputer Cmdlet","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/435e10e4-992a-4281-96f3-38b11106adde.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_computer_discovery_get_adcomputer.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"1114e048-b69c-4f41-bc20-657245ae6e3f","title":"User Discovery And Export Via Get-ADUser Cmdlet","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/1114e048-b69c-4f41-bc20-657245ae6e3f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_user_discovery_get_aduser.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"f1086bf7-a0c4-4a37-9102-01e573caf4a0","title":"Renamed Whoami Execution","status":"test","level":"critical","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f1086bf7-a0c4-4a37-9102-01e573caf4a0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_whoami.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"502b42de-4306-40b4-9596-6f590c81f073","title":"Local Accounts Discovery","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/502b42de-4306-40b4-9596-6f590c81f073.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_local_system_owner_account_discovery.yml","author":"Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community","kind":"sigma"},{"id":"e9142d84-fbe0-401d-ac50-3e519fb00c89","title":"WhoAmI as Parameter","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/e9142d84-fbe0-401d-ac50-3e519fb00c89.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_whoami_as_param.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"fa3c117a-bc0d-416e-a31b-0c0e80653efb","title":"Chopper Webshell Process Pattern","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/fa3c117a-bc0d-416e-a31b-0c0e80653efb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_webshell_chopper.yml","author":"Florian Roth (Nextron Systems), MSTI (query)","kind":"sigma"},{"id":"4ebc877f-4612-45cb-b3a5-8e3834db36c9","title":"Webshell Hacking Activity Patterns","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/4ebc877f-4612-45cb-b3a5-8e3834db36c9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_webshell_hacking.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"bed2a484-9348-4143-8a8a-b801c979301c","title":"Webshell Detection With Command Line Keywords","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/bed2a484-9348-4143-8a8a-b801c979301c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_webshell_recon_commands_and_processes.yml","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson","kind":"sigma"},{"id":"c248c896-e412-4279-8c15-1c558067b6fa","title":"Enumerate All Information With Whoami.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/c248c896-e412-4279-8c15-1c558067b6fa.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_whoami_all_execution.yml","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"79ce34ca-af29-4d0e-b832-fc1b377020db","title":"Whoami.EXE Execution From Privileged Process","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/79ce34ca-af29-4d0e-b832-fc1b377020db.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_whoami_execution_from_high_priv_process.yml","author":"Florian Roth (Nextron Systems), Teymur Kheirkhabarov","kind":"sigma"},{"id":"bd8b828d-0dca-48e1-8a63-8a58ecf2644f","title":"Group Membership Reconnaissance Via Whoami.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/bd8b828d-0dca-48e1-8a63-8a58ecf2644f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_whoami_groups_discovery.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"c30fb093-1109-4dc8-88a8-b30d11c95a5d","title":"Whoami.EXE Execution With Output Option","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/c30fb093-1109-4dc8-88a8-b30d11c95a5d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_whoami_output.yml","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"8de1cbe8-d6f5-496d-8237-5f44a721c7a0","title":"Whoami.EXE Execution Anomaly","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/8de1cbe8-d6f5-496d-8237-5f44a721c7a0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_whoami_parent_anomaly.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"97a80ec7-0e2f-4d05-9ef4-65760e634f6b","title":"Security Privileges Enumeration Via Whoami.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/97a80ec7-0e2f-4d05-9ef4-65760e634f6b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_whoami_priv_discovery.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0093","name":"Behavioral Detection of User Discovery via Local and Remote Enumeration","url":"https://attack.mitre.org/detectionstrategies/DET0093","stix_id":"x-mitre-detection-strategy--050d236f-745a-4801-add6-50cb58248615","relationship_id":"relationship--8fdf3a18-e1c3-4db4-8f68-15121c910826","description":"","analytics":[{"id":"AN0254","name":"Analytic 0254","guidance":"Adversary launches built-in system tools (e.g., whoami, query user, net user) or scripts that enumerate user account information via local execution or remote API queries (e.g., WMI, PowerShell).","url":"https://attack.mitre.org/detectionstrategies/DET0093#AN0254","platforms":["Windows"],"tuning":[{"field":"ParentProcessContext","description":"Identify if enumeration originates from non-interactive shell or system service"},{"field":"TimeWindow","description":"Tune temporal grouping of enumeration + lateral movement attempts"},{"field":"UserContext","description":"Flag unexpected users issuing enumeration commands (e.g., service accounts)"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0254","source_url":"https://attack.mitre.org/detectionstrategies/DET0093#AN0254","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0064","component":"Command Execution","name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","platforms":["Windows"],"analytic_id":"AN0254","source_url":"https://attack.mitre.org/detectionstrategies/DET0093#AN0254","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN0255","name":"Analytic 0255","guidance":"Adversary runs commands like `whoami`, `id`, `w`, or `cat /etc/passwd` from non-interactive or scripting contexts to enumerate system user details.","url":"https://attack.mitre.org/detectionstrategies/DET0093#AN0255","platforms":["Linux"],"tuning":[{"field":"CommandLineRegex","description":"Tune detection based on argument presence (e.g., `cat /etc/passwd` vs. `cat` alone)"},{"field":"ShellContext","description":"Identify if command issued via cron, systemd, or reverse shell"},{"field":"AccessFrequency","description":"Define how often user/account commands are expected on endpoint"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN0255","source_url":"https://attack.mitre.org/detectionstrategies/DET0093#AN0255","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0256","name":"Analytic 0256","guidance":"Adversary uses `dscl`, `who`, or environment variables like `$USER` to identify accounts or sessions via Terminal or malicious LaunchAgents.","url":"https://attack.mitre.org/detectionstrategies/DET0093#AN0256","platforms":["macOS"],"tuning":[{"field":"LaunchAgentPersistence","description":"Correlate dscl usage with known persistence vectors"},{"field":"CommandExecutionPath","description":"Distinguish between user-initiated terminal vs. script execution"},{"field":"UsernameEnumerationPattern","description":"Regex-based pattern tuning for `dscl . -list /Users` + grep filters"}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"macos:unifiedlog","channel":"subsystem:com.apple.Terminal","platforms":["macOS"],"analytic_id":"AN0256","source_url":"https://attack.mitre.org/detectionstrategies/DET0093#AN0256","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0032","component":"Process Creation","name":"macos:endpointsecurity","channel":"ES_EVENT_TYPE_NOTIFY_EXEC","platforms":["macOS"],"analytic_id":"AN0256","source_url":"https://attack.mitre.org/detectionstrategies/DET0093#AN0256","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0257","name":"Analytic 0257","guidance":"Adversary executes CLI commands like `show users`, `show ssh`, or attempts to dump AAA user lists from routers or switches.","url":"https://attack.mitre.org/detectionstrategies/DET0093#AN0257","platforms":["Network Devices"],"tuning":[{"field":"CLICommandBaseline","description":"Expected command set per device role/user role combination"},{"field":"DeviceRoleSensitivity","description":"Correlate access with core vs. edge vs. management plane sensitivity"},{"field":"CommandFrequencyThreshold","description":"Detect burst usage of `show` or `debug` commands by non-admin users"}],"log_sources":[{"component_id":"DC0021","component":"OS API Execution","name":"networkdevice:syslog","channel":"aaa privilege_exec","platforms":["Network Devices"],"analytic_id":"AN0257","source_url":"https://attack.mitre.org/detectionstrategies/DET0093#AN0257","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"},{"component_id":"DC0064","component":"Command Execution","name":"networkdevice:syslog","channel":"eventlog","platforms":["Network Devices"],"analytic_id":"AN0257","source_url":"https://attack.mitre.org/detectionstrategies/DET0093#AN0257","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0021","name":"OS API Execution","tag":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S1087","name":"AsyncRAT","page":"tools/S1087/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0521","name":"BloodHound","page":"tools/S0521/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0250","name":"Koadic","page":"tools/S0250/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0590","name":"NBTscan","page":"tools/S0590/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0192","name":"Pupy","page":"tools/S0192/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0262","name":"QuasarRAT","page":"tools/S0262/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S1087","name":"AsyncRAT","page":"tools/S1087/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0521","name":"BloodHound","page":"tools/S0521/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0250","name":"Koadic","page":"tools/S0250/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0590","name":"NBTscan","page":"tools/S0590/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0192","name":"Pupy","page":"tools/S0192/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0262","name":"QuasarRAT","page":"tools/S0262/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0013","name":"PlugX","url":"https://attack.mitre.org/software/S0013","kind":"malware","description":"[PlugX](https://attack.mitre.org/software/S0013) has the ability to gather the username from the victim’s machine.(Citation: Eset PlugX Korplug Mustang Panda March 2022)","relationship_id":"relationship--f6353949-0c13-4254-b7a0-a7ebc7a80f99","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","description":"Alexandre Cote Cyr. (2022, March 23). Mustang Panda’s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025.","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"}]},{"id":"S0015","name":"Ixeshe","url":"https://attack.mitre.org/software/S0015","kind":"malware","description":"[Ixeshe](https://attack.mitre.org/software/S0015) collects the username from the victim’s machine.(Citation: Trend Micro IXESHE 2012)","relationship_id":"relationship--dfa0d5cd-0e3d-4e21-ad3f-3653134cfa8b","references":[{"source_name":"Trend Micro IXESHE 2012","description":"Sancho, D., et al. (2012, May 22). IXESHE An APT Campaign. Retrieved June 7, 2019.","url":"https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf"}]},{"id":"S0017","name":"BISCUIT","url":"https://attack.mitre.org/software/S0017","kind":"malware","description":"[BISCUIT](https://attack.mitre.org/software/S0017) has a command to gather the username from the system.(Citation: Mandiant APT1 Appendix)","relationship_id":"relationship--ec037573-058a-43d5-a76e-bd76e99953dd","references":[{"source_name":"Mandiant APT1 Appendix","description":"Mandiant. (n.d.). Appendix C (Digital) - The Malware Arsenal. Retrieved July 18, 2016.","url":"https://www.mandiant.com/sites/default/files/2021-09/mandiant-apt1-report.pdf"}]},{"id":"S0021","name":"Derusbi","url":"https://attack.mitre.org/software/S0021","kind":"malware","description":"A Linux version of [Derusbi](https://attack.mitre.org/software/S0021) checks if the victim user ID is anything other than zero (normally used for root), and the malware will not execute if it does not have root privileges. [Derusbi](https://attack.mitre.org/software/S0021) also gathers the username of the victim.(Citation: Fidelis Turbo)","relationship_id":"relationship--af66e48f-3232-4f78-ad3e-5a404f7ae3a1","references":[{"source_name":"Fidelis Turbo","description":"Fidelis Cybersecurity. (2016, February 29). The Turbo Campaign, Featuring Derusbi for 64-bit Linux. Retrieved March 2, 2016.","url":"https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2016/2016.02.29.Turbo_Campaign_Derusbi/TA_Fidelis_Turbo_1602_0.pdf"}]},{"id":"S0024","name":"Dyre","url":"https://attack.mitre.org/software/S0024","kind":"malware","description":"[Dyre](https://attack.mitre.org/software/S0024) has the ability to identify the users on a compromised host.(Citation: Malwarebytes Dyreza November 2015)","relationship_id":"relationship--143dbc8a-0b00-4510-aacf-96437d87ea2b","references":[{"source_name":"Malwarebytes Dyreza November 2015","description":"hasherezade. (2015, November 4). A Technical Look At Dyreza. Retrieved June 15, 2020.","url":"https://blog.malwarebytes.com/threat-analysis/2015/11/a-technical-look-at-dyreza/"}]},{"id":"S0058","name":"SslMM","url":"https://attack.mitre.org/software/S0058","kind":"malware","description":"[SslMM](https://attack.mitre.org/software/S0058) sends the logged-on username to its hard-coded C2.(Citation: Baumgartner Naikon 2015)","relationship_id":"relationship--0df8e968-716a-4de9-9669-862af62d6eb6","references":[{"source_name":"Baumgartner Naikon 2015","description":"Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"}]},{"id":"S0059","name":"WinMM","url":"https://attack.mitre.org/software/S0059","kind":"malware","description":"[WinMM](https://attack.mitre.org/software/S0059) uses NetUser-GetInfo to identify that it is running under an “Admin” account on the local system.(Citation: Baumgartner Naikon 2015)","relationship_id":"relationship--af6e3f9e-7c71-484d-ab8e-5adaaaedea36","references":[{"source_name":"Baumgartner Naikon 2015","description":"Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"}]},{"id":"S0060","name":"Sys10","url":"https://attack.mitre.org/software/S0060","kind":"malware","description":"[Sys10](https://attack.mitre.org/software/S0060) collects the account name of the logged-in user and sends it to the C2.(Citation: Baumgartner Naikon 2015)","relationship_id":"relationship--fea6e347-95f5-4d97-8781-4cc15d6b5b0c","references":[{"source_name":"Baumgartner Naikon 2015","description":"Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"}]},{"id":"S0084","name":"Mis-Type","url":"https://attack.mitre.org/software/S0084","kind":"malware","description":"[Mis-Type](https://attack.mitre.org/software/S0084) runs tests to determine the privilege level of the compromised user.(Citation: Cylance Dust Storm)","relationship_id":"relationship--a1e9769e-5172-4959-84d3-5a28796f86e1","references":[{"source_name":"Cylance Dust Storm","description":"Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}]},{"id":"S0085","name":"S-Type","url":"https://attack.mitre.org/software/S0085","kind":"malware","description":"[S-Type](https://attack.mitre.org/software/S0085) has run tests to determine the privilege level of the compromised user.(Citation: Cylance Dust Storm)","relationship_id":"relationship--17bc166c-7598-4297-9cc1-1ee9ef4182a2","references":[{"source_name":"Cylance Dust Storm","description":"Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}]},{"id":"S0091","name":"Epic","url":"https://attack.mitre.org/software/S0091","kind":"malware","description":"[Epic](https://attack.mitre.org/software/S0091) collects the user name from the victim’s machine.(Citation: Kaspersky Turla Aug 2014)","relationship_id":"relationship--1547f28f-d6b7-43cc-8b89-0eaa524648b8","references":[{"source_name":"Kaspersky Turla Aug 2014","description":"Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08080105/KL_Epic_Turla_Technical_Appendix_20140806.pdf"}]},{"id":"S0092","name":"Agent.btz","url":"https://attack.mitre.org/software/S0092","kind":"malware","description":"[Agent.btz](https://attack.mitre.org/software/S0092) obtains the victim username and saves it to a file.(Citation: ThreatExpert Agent.btz)","relationship_id":"relationship--6c71a59f-05e6-44cc-ace5-33200e1f0846","references":[{"source_name":"ThreatExpert Agent.btz","description":"Shevchenko, S.. (2008, November 30). Agent.btz - A Threat That Hit Pentagon. Retrieved April 8, 2016.","url":"http://blog.threatexpert.com/2008/11/agentbtz-threat-that-hit-pentagon.html"}]},{"id":"S0093","name":"Backdoor.Oldrea","url":"https://attack.mitre.org/software/S0093","kind":"malware","description":"[Backdoor.Oldrea](https://attack.mitre.org/software/S0093) collects the current username from the victim.(Citation: Symantec Dragonfly)","relationship_id":"relationship--d2d9a619-4379-4e15-9115-40ca9209f316","references":[{"source_name":"Symantec Dragonfly","description":"Symantec Security Response. (2014, June 30). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.","url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"}]},{"id":"S0094","name":"Trojan.Karagany","url":"https://attack.mitre.org/software/S0094","kind":"malware","description":"[Trojan.Karagany](https://attack.mitre.org/software/S0094) can gather information about the user on a compromised host.(Citation: Secureworks Karagany July 2019)","relationship_id":"relationship--00ce5c68-cb85-46d1-a6ba-7b2b767b0f09","references":[{"source_name":"Secureworks Karagany July 2019","description":"Secureworks. (2019, July 24). Updated Karagany Malware Targets Energy Sector. Retrieved August 12, 2020.","url":"https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector"}]},{"id":"S0098","name":"T9000","url":"https://attack.mitre.org/software/S0098","kind":"malware","description":"[T9000](https://attack.mitre.org/software/S0098) gathers and beacons the username of the logged in account during installation. It will also gather the username of running processes to determine if it is running as SYSTEM.(Citation: Palo Alto T9000 Feb 2016)","relationship_id":"relationship--a6150e37-2411-409f-82a0-e259d55d1166","references":[{"source_name":"Palo Alto T9000 Feb 2016","description":"Grunzweig, J. and Miller-Osborn, J.. (2016, February 4). T9000: Advanced Modular Backdoor Uses Complex Anti-Analysis Techniques. Retrieved April 15, 2016.","url":"http://researchcenter.paloaltonetworks.com/2016/02/t9000-advanced-modular-backdoor-uses-complex-anti-analysis-techniques/"}]},{"id":"S0113","name":"Prikormka","url":"https://attack.mitre.org/software/S0113","kind":"malware","description":"A module in [Prikormka](https://attack.mitre.org/software/S0113) collects information from the victim about the current user name.(Citation: ESET Operation Groundbait)","relationship_id":"relationship--fce2d07b-7bc7-497a-b21a-75a23fbccf50","references":[{"source_name":"ESET Operation Groundbait","description":"Cherepanov, A.. (2016, May 17). Operation Groundbait: Analysis of a surveillance toolkit. Retrieved May 18, 2016.","url":"http://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf"}]},{"id":"S0115","name":"Crimson","url":"https://attack.mitre.org/software/S0115","kind":"malware","description":"[Crimson](https://attack.mitre.org/software/S0115) can identify the user on a targeted system.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)","relationship_id":"relationship--6cdada54-681f-47ac-834b-4d4e2c86ec75","references":[{"source_name":"Kaspersky Transparent Tribe August 2020","description":"Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.","url":"https://securelist.com/transparent-tribe-part-1/98127/"},{"source_name":"Proofpoint Operation Transparent Tribe March 2016","description":"Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"},{"source_name":"Cisco Talos Transparent Tribe Education Campaign July 2022","description":"N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.","url":"https://blog.talosintelligence.com/2022/07/transparent-tribe-targets-education.html"}]},{"id":"S0125","name":"Remsec","url":"https://attack.mitre.org/software/S0125","kind":"malware","description":"[Remsec](https://attack.mitre.org/software/S0125) can obtain information about the current user.(Citation: Kaspersky ProjectSauron Technical Analysis)","relationship_id":"relationship--d1222ff7-b93c-40a7-99bd-217d795d8d58","references":[{"source_name":"Kaspersky ProjectSauron Technical Analysis","description":"Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.","url":"https://securelist.com/files/2016/07/The-ProjectSauron-APT_Technical_Analysis_KL.pdf"}]},{"id":"S0130","name":"Unknown Logger","url":"https://attack.mitre.org/software/S0130","kind":"malware","description":"[Unknown Logger](https://attack.mitre.org/software/S0130) can obtain information about the victim usernames.(Citation: Forcepoint Monsoon)","relationship_id":"relationship--1d3296a5-9a15-4bd9-a294-ee014348136c","references":[{"source_name":"Forcepoint Monsoon","description":"Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.","url":"https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"}]},{"id":"S0139","name":"PowerDuke","url":"https://attack.mitre.org/software/S0139","kind":"malware","description":"[PowerDuke](https://attack.mitre.org/software/S0139) has commands to get the current user's name and SID.(Citation: Volexity PowerDuke November 2016)","relationship_id":"relationship--5efe685d-66a6-4f1f-8779-4aae5db859d0","references":[{"source_name":"Volexity PowerDuke November 2016","description":"Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.","url":"https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/"}]},{"id":"S0148","name":"RTM","url":"https://attack.mitre.org/software/S0148","kind":"malware","description":"[RTM](https://attack.mitre.org/software/S0148) can obtain the victim username and permissions.(Citation: ESET RTM Feb 2017)","relationship_id":"relationship--aad1cfa0-0df0-4768-87c2-5e59da2c5e44","references":[{"source_name":"ESET RTM Feb 2017","description":"Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.","url":"https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"}]},{"id":"S0149","name":"MoonWind","url":"https://attack.mitre.org/software/S0149","kind":"malware","description":"[MoonWind](https://attack.mitre.org/software/S0149) obtains the victim username.(Citation: Palo Alto MoonWind March 2017)","relationship_id":"relationship--818a401d-dd4d-426a-b89c-d33625380b8b","references":[{"source_name":"Palo Alto MoonWind March 2017","description":"Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.","url":"http://researchcenter.paloaltonetworks.com/2017/03/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/"}]},{"id":"S0153","name":"RedLeaves","url":"https://attack.mitre.org/software/S0153","kind":"malware","description":"[RedLeaves](https://attack.mitre.org/software/S0153) can obtain information about the logged on user both locally and for Remote Desktop sessions.(Citation: PWC Cloud Hopper Technical Annex April 2017)","relationship_id":"relationship--bd8aaa70-710d-45a7-bb43-6b2e37f7c797","references":[{"source_name":"PWC Cloud Hopper Technical Annex April 2017","description":"PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}]},{"id":"S0155","name":"WINDSHIELD","url":"https://attack.mitre.org/software/S0155","kind":"malware","description":"[WINDSHIELD](https://attack.mitre.org/software/S0155) can gather the victim user name.(Citation: FireEye APT32 May 2017)","relationship_id":"relationship--32218bd0-d598-4560-9a70-ab7d5c92f986","references":[{"source_name":"FireEye APT32 May 2017","description":"Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"}]},{"id":"S0161","name":"XAgentOSX","url":"https://attack.mitre.org/software/S0161","kind":"malware","description":"[XAgentOSX](https://attack.mitre.org/software/S0161) contains the getInfoOSX function to return the OS X version as well as the current user.(Citation: XAgentOSX 2017)","relationship_id":"relationship--31cd4eb1-f7b3-4030-b087-388d55faba03","references":[{"source_name":"XAgentOSX 2017","description":"Robert Falcone. (2017, February 14). XAgentOSX: Sofacy's Xagent macOS Tool. Retrieved July 12, 2017.","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/"}]},{"id":"S0162","name":"Komplex","url":"https://attack.mitre.org/software/S0162","kind":"malware","description":"The OsInfo function in [Komplex](https://attack.mitre.org/software/S0162) collects the current running username.(Citation: Sofacy Komplex Trojan)","relationship_id":"relationship--707d131d-39ff-4ea0-a8ef-63dd7ca2a854","references":[{"source_name":"Sofacy Komplex Trojan","description":"Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.","url":"https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/"}]},{"id":"S0168","name":"Gazer","url":"https://attack.mitre.org/software/S0168","kind":"malware","description":"[Gazer](https://attack.mitre.org/software/S0168) obtains the current user's security identifier.(Citation: Securelist WhiteBear Aug 2017)","relationship_id":"relationship--d219ed2b-2877-450f-9a69-a30f36497d14","references":[{"source_name":"Securelist WhiteBear Aug 2017","description":"Kaspersky Lab's Global Research & Analysis Team. (2017, August 30). Introducing WhiteBear. Retrieved September 21, 2017.","url":"https://securelist.com/introducing-whitebear/81638/"}]},{"id":"S0171","name":"Felismus","url":"https://attack.mitre.org/software/S0171","kind":"malware","description":"[Felismus](https://attack.mitre.org/software/S0171) collects the current username and sends it to the C2 server.(Citation: Forcepoint Felismus Mar 2017)","relationship_id":"relationship--427a9eb9-659d-433c-9e2c-9a66d115a9a3","references":[{"source_name":"Forcepoint Felismus Mar 2017","description":"Somerville, L. and Toro, A. (2017, March 30). Playing Cat & Mouse: Introducing the Felismus Malware. Retrieved November 16, 2017.","url":"https://blogs.forcepoint.com/security-labs/playing-cat-mouse-introducing-felismus-malware"}]},{"id":"S0172","name":"Reaver","url":"https://attack.mitre.org/software/S0172","kind":"malware","description":"[Reaver](https://attack.mitre.org/software/S0172) collects the victim's username.(Citation: Palo Alto Reaver Nov 2017)","relationship_id":"relationship--e0a0966c-7a2f-41b3-962f-3a6b22a5a8a9","references":[{"source_name":"Palo Alto Reaver Nov 2017","description":"Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017.","url":"https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"}]},{"id":"S0184","name":"POWRUNER","url":"https://attack.mitre.org/software/S0184","kind":"malware","description":"[POWRUNER](https://attack.mitre.org/software/S0184) may collect information about the currently logged in user by running <code>whoami</code> on a victim.(Citation: FireEye APT34 Dec 2017)","relationship_id":"relationship--5183147b-4563-4a01-a360-a419691e35f8","references":[{"source_name":"FireEye APT34 Dec 2017","description":"Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"}]},{"id":"S0186","name":"DownPaper","url":"https://attack.mitre.org/software/S0186","kind":"malware","description":"[DownPaper](https://attack.mitre.org/software/S0186) collects the victim username and sends it to the C2 server.(Citation: ClearSky Charming Kitten Dec 2017)","relationship_id":"relationship--6cf42ee6-a064-4d8a-99d4-8aa0f878ae2a","references":[{"source_name":"ClearSky Charming Kitten Dec 2017","description":"ClearSky Cyber Security. (2017, December). Charming Kitten. Retrieved December 27, 2017.","url":"http://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf"}]},{"id":"S0192","name":"Pupy","url":"https://attack.mitre.org/software/S0192","kind":"tool","description":"[Pupy](https://attack.mitre.org/software/S0192) can enumerate local information for Linux hosts and find currently logged on users for Windows hosts.(Citation: GitHub Pupy)","relationship_id":"relationship--39e6a7c0-5eb8-49fe-aec7-9ae9fe70723a","references":[{"source_name":"GitHub Pupy","description":"Nicolas Verdier. (n.d.). Retrieved January 29, 2018.","url":"https://github.com/n1nj4sec/pupy"}]},{"id":"S0201","name":"JPIN","url":"https://attack.mitre.org/software/S0201","kind":"malware","description":"[JPIN](https://attack.mitre.org/software/S0201) can obtain the victim user name.(Citation: Microsoft PLATINUM April 2016)","relationship_id":"relationship--7a181608-6005-4d42-b4a2-0e2de8b8ff95","references":[{"source_name":"Microsoft PLATINUM April 2016","description":"Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}]},{"id":"S0214","name":"HAPPYWORK","url":"https://attack.mitre.org/software/S0214","kind":"malware","description":"can collect the victim user name.(Citation: FireEye APT37 Feb 2018)","relationship_id":"relationship--6eb55cc5-1c90-44ce-ab80-0c938521f1cf","references":[{"source_name":"FireEye APT37 Feb 2018","description":"FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}]},{"id":"S0219","name":"WINERACK","url":"https://attack.mitre.org/software/S0219","kind":"malware","description":"[WINERACK](https://attack.mitre.org/software/S0219) can gather information on the victim username.(Citation: FireEye APT37 Feb 2018)","relationship_id":"relationship--2f8d5603-0876-41dd-9fdb-ca9dc0ad6253","references":[{"source_name":"FireEye APT37 Feb 2018","description":"FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}]},{"id":"S0223","name":"POWERSTATS","url":"https://attack.mitre.org/software/S0223","kind":"malware","description":"[POWERSTATS](https://attack.mitre.org/software/S0223) has the ability to identify the username on the compromised host.(Citation: TrendMicro POWERSTATS V3 June 2019)","relationship_id":"relationship--1567eaca-2b2e-44df-b447-87769738e00a","references":[{"source_name":"TrendMicro POWERSTATS V3 June 2019","description":"Lunghi, D. and Horejsi, J.. (2019, June 10). MuddyWater Resurfaces, Uses Multi-Stage Backdoor POWERSTATS V3 and New Post-Exploitation Tools. Retrieved May 14, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/muddywater-resurfaces-uses-multi-stage-backdoor-powerstats-v3-and-new-post-exploitation-tools/"}]},{"id":"S0228","name":"NanHaiShu","url":"https://attack.mitre.org/software/S0228","kind":"malware","description":"[NanHaiShu](https://attack.mitre.org/software/S0228) collects the username from the victim.(Citation: fsecure NanHaiShu July 2016)","relationship_id":"relationship--f5bbb96e-40b9-4a8c-a53d-bcd843daeac2","references":[{"source_name":"fsecure NanHaiShu July 2016","description":"F-Secure Labs. (2016, July). NANHAISHU RATing the South China Sea. Retrieved July 6, 2018.","url":"https://www.f-secure.com/documents/996508/1030745/nanhaishu_whitepaper.pdf"}]},{"id":"S0236","name":"Kwampirs","url":"https://attack.mitre.org/software/S0236","kind":"malware","description":"[Kwampirs](https://attack.mitre.org/software/S0236) collects registered owner details by using the commands <code>systeminfo</code> and <code>net config workstation</code>.(Citation: Symantec Orangeworm April 2018)","relationship_id":"relationship--64006d31-51ea-4908-8b09-2650fdc6b4f8","references":[{"source_name":"Symantec Orangeworm April 2018","description":"Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.","url":"https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"}]},{"id":"S0237","name":"GravityRAT","url":"https://attack.mitre.org/software/S0237","kind":"malware","description":"[GravityRAT](https://attack.mitre.org/software/S0237) collects the victim username along with other account information (account type, description, full name, SID and status).(Citation: Talos GravityRAT)","relationship_id":"relationship--bfb687f5-0c7d-4ac3-a295-26f1b96dc360","references":[{"source_name":"Talos GravityRAT","description":"Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.","url":"https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html"}]},{"id":"S0240","name":"ROKRAT","url":"https://attack.mitre.org/software/S0240","kind":"malware","description":"[ROKRAT](https://attack.mitre.org/software/S0240) can collect the username from a compromised host.(Citation: Malwarebytes RokRAT VBA January 2021)","relationship_id":"relationship--c78a0329-8160-40d2-83f4-f5076671e786","references":[{"source_name":"Malwarebytes RokRAT VBA January 2021","description":"Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.","url":"https://blog.malwarebytes.com/threat-analysis/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat/"}]},{"id":"S0241","name":"RATANKBA","url":"https://attack.mitre.org/software/S0241","kind":"malware","description":"[RATANKBA](https://attack.mitre.org/software/S0241) runs the <code>whoami</code> and <code>query user</code> commands.(Citation: RATANKBA)","relationship_id":"relationship--28ffc627-936b-4572-93f6-0c46cb361dda","references":[{"source_name":"RATANKBA","description":"Trend Micro. (2017, February 27). RATANKBA: Delving into Large-scale Watering Holes against Enterprises. Retrieved May 22, 2018.","url":"https://www.trendmicro.com/en_us/research/17/b/ratankba-watering-holes-against-enterprises.html"}]},{"id":"S0242","name":"SynAck","url":"https://attack.mitre.org/software/S0242","kind":"malware","description":"[SynAck](https://attack.mitre.org/software/S0242) gathers user names from infected hosts.(Citation: SecureList SynAck Doppelgänging May 2018)","relationship_id":"relationship--2fededb7-e713-495c-a317-919c037434a8","references":[{"source_name":"SecureList SynAck Doppelgänging May 2018","description":"Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.","url":"https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/"}]},{"id":"S0248","name":"yty","url":"https://attack.mitre.org/software/S0248","kind":"malware","description":"[yty](https://attack.mitre.org/software/S0248) collects the victim’s username.(Citation: ASERT Donot March 2018)","relationship_id":"relationship--8732cda7-068e-439d-a25a-1b056363d1f7","references":[{"source_name":"ASERT Donot March 2018","description":"Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018.","url":"https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/"}]},{"id":"S0249","name":"Gold Dragon","url":"https://attack.mitre.org/software/S0249","kind":"malware","description":"[Gold Dragon](https://attack.mitre.org/software/S0249) collects the endpoint victim's username and uses it as a basis for downloading additional components from the C2 server.(Citation: McAfee Gold Dragon)","relationship_id":"relationship--41634cea-6236-4013-bda3-345bcba4f40f","references":[{"source_name":"McAfee Gold Dragon","description":"Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"}]},{"id":"S0250","name":"Koadic","url":"https://attack.mitre.org/software/S0250","kind":"tool","description":"[Koadic](https://attack.mitre.org/software/S0250) can identify logged in users across the domain and views user sessions.(Citation: Github Koadic)(Citation: MalwareBytes LazyScripter Feb 2021)","relationship_id":"relationship--3298bf92-55a2-49eb-aa5e-0530e8a51eeb","references":[{"source_name":"MalwareBytes LazyScripter Feb 2021","description":"Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"},{"source_name":"Github Koadic","description":"Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.","url":"https://github.com/offsecginger/koadic"}]},{"id":"S0251","name":"Zebrocy","url":"https://attack.mitre.org/software/S0251","kind":"malware","description":"[Zebrocy](https://attack.mitre.org/software/S0251) gets the username from the system.(Citation: ESET Zebrocy Nov 2018)(Citation: CISA Zebrocy Oct 2020)","relationship_id":"relationship--46452566-0f0f-4fe9-9cef-ef7e3d6eee36","references":[{"source_name":"ESET Zebrocy Nov 2018","description":"ESET. (2018, November 20). Sednit: What’s going on with Zebrocy?. Retrieved February 12, 2019.","url":"https://www.welivesecurity.com/2018/11/20/sednit-whats-going-zebrocy/"},{"source_name":"CISA Zebrocy Oct 2020","description":"CISA. (2020, October 29). Malware Analysis Report (AR20-303B). Retrieved December 9, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303b"}]},{"id":"S0256","name":"Mosquito","url":"https://attack.mitre.org/software/S0256","kind":"malware","description":"[Mosquito](https://attack.mitre.org/software/S0256) runs <code>whoami</code> on the victim’s machine.(Citation: ESET Turla Mosquito Jan 2018)","relationship_id":"relationship--1c360b2c-8004-4978-ba70-b0bb2257a791","references":[{"source_name":"ESET Turla Mosquito Jan 2018","description":"ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"}]},{"id":"S0257","name":"VERMIN","url":"https://attack.mitre.org/software/S0257","kind":"malware","description":"[VERMIN](https://attack.mitre.org/software/S0257) gathers the username from the victim’s machine.(Citation: Unit 42 VERMIN Jan 2018)","relationship_id":"relationship--e0bb9da4-4cf5-4fcc-89c9-2cf174a34cae","references":[{"source_name":"Unit 42 VERMIN Jan 2018","description":"Lancaster, T., Cortes, J. (2018, January 29). VERMIN: Quasar RAT and Custom Malware Used In Ukraine. Retrieved July 5, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"}]},{"id":"S0258","name":"RGDoor","url":"https://attack.mitre.org/software/S0258","kind":"malware","description":"[RGDoor](https://attack.mitre.org/software/S0258) executes the <code>whoami</code> on the victim’s machine.(Citation: Unit 42 RGDoor Jan 2018)","relationship_id":"relationship--ada55a0e-2f38-4da1-9ebd-8dd2f2461dfc","references":[{"source_name":"Unit 42 RGDoor Jan 2018","description":"Falcone, R. (2018, January 25). OilRig uses RGDoor IIS Backdoor on Targets in the Middle East. Retrieved July 6, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/"}]},{"id":"S0260","name":"InvisiMole","url":"https://attack.mitre.org/software/S0260","kind":"malware","description":"[InvisiMole](https://attack.mitre.org/software/S0260) lists local users and session information.(Citation: ESET InvisiMole June 2018)","relationship_id":"relationship--524261f3-8b87-4c99-b99b-1e78032f072c","references":[{"source_name":"ESET InvisiMole June 2018","description":"Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"}]},{"id":"S0262","name":"QuasarRAT","url":"https://attack.mitre.org/software/S0262","kind":"tool","description":"[QuasarRAT](https://attack.mitre.org/software/S0262) can enumerate the username and account type.(Citation: CISA AR18-352A Quasar RAT December 2018)","relationship_id":"relationship--605478eb-c1c2-4029-bf36-9cc8981f2bee","references":[{"source_name":"CISA AR18-352A Quasar RAT December 2018","description":"CISA. (2018, December 18). Analysis Report (AR18-352A) Quasar Open-Source Remote Administration Tool. Retrieved August 1, 2022.","url":"https://www.cisa.gov/uscert/ncas/analysis-reports/AR18-352A"}]},{"id":"S0265","name":"Kazuar","url":"https://attack.mitre.org/software/S0265","kind":"malware","description":"[Kazuar](https://attack.mitre.org/software/S0265) gathers information on users.(Citation: Unit 42 Kazuar May 2017)","relationship_id":"relationship--719f0c42-8eb8-461b-8f35-cf5dfc42e47b","references":[{"source_name":"Unit 42 Kazuar May 2017","description":"Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/"}]},{"id":"S0266","name":"TrickBot","url":"https://attack.mitre.org/software/S0266","kind":"malware","description":"[TrickBot](https://attack.mitre.org/software/S0266) can identify the user and groups the user belongs to on a compromised host.(Citation: Cyberreason Anchor December 2019)","relationship_id":"relationship--03251067-ee3a-49e4-addc-86daaa8a3203","references":[{"source_name":"Cyberreason Anchor December 2019","description":"Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September 10, 2020.","url":"https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"}]},{"id":"S0267","name":"FELIXROOT","url":"https://attack.mitre.org/software/S0267","kind":"malware","description":"[FELIXROOT](https://attack.mitre.org/software/S0267) collects the username from the victim’s machine.(Citation: FireEye FELIXROOT July 2018)(Citation: ESET GreyEnergy Oct 2018)","relationship_id":"relationship--d9d7d861-66c9-469e-8baa-d72c7844a40f","references":[{"source_name":"ESET GreyEnergy Oct 2018","description":"Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf"},{"source_name":"FireEye FELIXROOT July 2018","description":"Patil, S. (2018, June 26). Microsoft Office Vulnerabilities Used to Distribute FELIXROOT Backdoor in Recent Campaign. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20200607025424/https://www.fireeye.com/blog/threat-research/2018/07/microsoft-office-vulnerabilities-used-to-distribute-felixroot-backdoor.html"}]},{"id":"S0269","name":"QUADAGENT","url":"https://attack.mitre.org/software/S0269","kind":"malware","description":"[QUADAGENT](https://attack.mitre.org/software/S0269) gathers the victim username.(Citation: Unit 42 QUADAGENT July 2018)","relationship_id":"relationship--fc52b3a9-96b2-4595-bedf-54289a42117a","references":[{"source_name":"Unit 42 QUADAGENT July 2018","description":"Lee, B., Falcone, R. (2018, July 25). OilRig Targets Technology Service Provider and Government Agency with QUADAGENT. Retrieved August 9, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"}]},{"id":"S0270","name":"RogueRobin","url":"https://attack.mitre.org/software/S0270","kind":"malware","description":"[RogueRobin](https://attack.mitre.org/software/S0270) collects the victim’s username and whether that user is an admin.(Citation: Unit 42 DarkHydrus July 2018)","relationship_id":"relationship--62bd74e2-ca03-4564-ae9b-75637c4c6acf","references":[{"source_name":"Unit 42 DarkHydrus July 2018","description":"Falcone, R., et al. (2018, July 27). New Threat Actor Group DarkHydrus Targets Middle East Government. Retrieved August 2, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"}]},{"id":"S0272","name":"NDiskMonitor","url":"https://attack.mitre.org/software/S0272","kind":"malware","description":"[NDiskMonitor](https://attack.mitre.org/software/S0272) obtains the victim username and encrypts the information to send over its C2 channel.(Citation: TrendMicro Patchwork Dec 2017)","relationship_id":"relationship--06ef19c1-8490-42cc-b345-45f3aa29fc5f","references":[{"source_name":"TrendMicro Patchwork Dec 2017","description":"Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"id":"S0275","name":"UPPERCUT","url":"https://attack.mitre.org/software/S0275","kind":"malware","description":"[UPPERCUT](https://attack.mitre.org/software/S0275) has the capability to collect the current logged on user’s username from a machine.(Citation: FireEye APT10 Sept 2018)","relationship_id":"relationship--2ed969c0-be8f-43d1-8226-1009faefaa20","references":[{"source_name":"FireEye APT10 Sept 2018","description":"Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"}]},{"id":"S0280","name":"MirageFox","url":"https://attack.mitre.org/software/S0280","kind":"malware","description":"[MirageFox](https://attack.mitre.org/software/S0280) can gather the username from the victim’s machine.(Citation: APT15 Intezer June 2018)","relationship_id":"relationship--cb68541e-3ca7-4e2d-892d-c30b50107b39","references":[{"source_name":"APT15 Intezer June 2018","description":"Rosenberg, J. (2018, June 14). MirageFox: APT15 Resurfaces With New Tools Based On Old Ones. Retrieved September 21, 2018.","url":"https://web.archive.org/web/20180615122133/https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/"}]},{"id":"S0284","name":"More_eggs","url":"https://attack.mitre.org/software/S0284","kind":"malware","description":"[More_eggs](https://attack.mitre.org/software/S0284) has the capability to gather the username from the victim's machine.(Citation: Talos Cobalt Group July 2018)(Citation: Security Intelligence More Eggs Aug 2019)","relationship_id":"relationship--f2da9aaa-de4a-4825-b82d-d07ecc34e35c","references":[{"source_name":"Talos Cobalt Group July 2018","description":"Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"},{"source_name":"Security Intelligence More Eggs Aug 2019","description":"Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.","url":"https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/"}]},{"id":"S0331","name":"Agent Tesla","url":"https://attack.mitre.org/software/S0331","kind":"malware","description":"[Agent Tesla](https://attack.mitre.org/software/S0331) can collect the username from the victim’s machine.(Citation: DigiTrust Agent Tesla Jan 2017)(Citation: Fortinet Agent Tesla April 2018)(Citation: Malwarebytes Agent Tesla April 2020)","relationship_id":"relationship--3e370a6e-2a3c-4e56-aa57-fecab8d09709","references":[{"source_name":"DigiTrust Agent Tesla Jan 2017","description":"The DigiTrust Group. (2017, January 12). The Rise of Agent Tesla. Retrieved November 5, 2018.","url":"https://www.digitrustgroup.com/agent-tesla-keylogger/"},{"source_name":"Fortinet Agent Tesla April 2018","description":"Zhang, X. (2018, April 05). Analysis of New Agent Tesla Spyware Variant. Retrieved November 5, 2018.","url":"https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html"},{"source_name":"Malwarebytes Agent Tesla April 2020","description":"Jazi, H. (2020, April 16). New AgentTesla variant steals WiFi credentials. Retrieved May 19, 2020.","url":"https://blog.malwarebytes.com/threat-analysis/2020/04/new-agenttesla-variant-steals-wifi-credentials/"}]},{"id":"S0332","name":"Remcos","url":"https://attack.mitre.org/software/S0332","kind":"tool","description":"[Remcos](https://attack.mitre.org/software/S0332) can enumerate the username on targeted hosts.(Citation: Fortinet Remcos Campaign NOV 2024)","relationship_id":"relationship--f470eced-1e1c-49a8-b3b2-5ded410dc2e2","references":[{"source_name":"Fortinet Remcos Campaign NOV 2024","description":"Zhang, X. (2024, November 8). New Campaign Uses Remcos RAT to Exploit Victims. Retrieved April 16, 2026.","url":"https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"}]},{"id":"S0334","name":"DarkComet","url":"https://attack.mitre.org/software/S0334","kind":"malware","description":"[DarkComet](https://attack.mitre.org/software/S0334) gathers the username from the victim’s machine.(Citation: TrendMicro DarkComet Sept 2014)","relationship_id":"relationship--e96e17e7-4349-4393-b875-5bab4e8ffa5a","references":[{"source_name":"TrendMicro DarkComet Sept 2014","description":"TrendMicro. (2014, September 03). DARKCOMET. Retrieved November 6, 2018.","url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/DARKCOMET"}]},{"id":"S0339","name":"Micropsia","url":"https://attack.mitre.org/software/S0339","kind":"malware","description":"[Micropsia](https://attack.mitre.org/software/S0339) collects the username from the victim’s machine.(Citation: Talos Micropsia June 2017)","relationship_id":"relationship--693372c1-418e-45c3-9b0e-0c21d705d1d2","references":[{"source_name":"Talos Micropsia June 2017","description":"Rascagneres, P., Mercer, W. (2017, June 19). Delphi Used To Score Against Palestine. Retrieved November 13, 2018.","url":"https://blog.talosintelligence.com/2017/06/palestine-delphi.html"}]},{"id":"S0340","name":"Octopus","url":"https://attack.mitre.org/software/S0340","kind":"malware","description":"[Octopus](https://attack.mitre.org/software/S0340) can collect the username from the victim’s machine.(Citation: Securelist Octopus Oct 2018)","relationship_id":"relationship--348f9f2e-c959-4485-9a0b-e95f6d4ceb72","references":[{"source_name":"Securelist Octopus Oct 2018","description":"Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.","url":"https://securelist.com/octopus-infested-seas-of-central-asia/88200/"}]},{"id":"S0344","name":"Azorult","url":"https://attack.mitre.org/software/S0344","kind":"malware","description":"[Azorult](https://attack.mitre.org/software/S0344) can collect the username from the victim’s machine.(Citation: Unit42 Azorult Nov 2018)","relationship_id":"relationship--1d82c2f3-0bca-49a0-b731-296a436eb003","references":[{"source_name":"Unit42 Azorult Nov 2018","description":"Yan, T., et al. (2018, November 21). New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit. Retrieved November 29, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-new-wine-old-bottle-new-azorult-variant-found-findmyname-campaign-using-fallout-exploit-kit/"}]},{"id":"S0348","name":"Cardinal RAT","url":"https://attack.mitre.org/software/S0348","kind":"malware","description":"[Cardinal RAT](https://attack.mitre.org/software/S0348) can collect the username from a victim machine.(Citation: PaloAlto CardinalRat Apr 2017)","relationship_id":"relationship--395fbd2c-7827-49b3-8121-72d54181f0b1","references":[{"source_name":"PaloAlto CardinalRat Apr 2017","description":"Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"}]},{"id":"S0350","name":"zwShell","url":"https://attack.mitre.org/software/S0350","kind":"malware","description":"[zwShell](https://attack.mitre.org/software/S0350) can obtain the name of the logged-in user on the victim.(Citation: McAfee Night Dragon)","relationship_id":"relationship--bd62c9fa-b1d4-4fb9-a892-99703e1f794d","references":[{"source_name":"McAfee Night Dragon","description":"McAfee® Foundstone® Professional Services and McAfee Labs™. (2011, February 10). Global Energy Cyberattacks: “Night Dragon”. Retrieved February 19, 2018.","url":"https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf"}]},{"id":"S0351","name":"Cannon","url":"https://attack.mitre.org/software/S0351","kind":"malware","description":"[Cannon](https://attack.mitre.org/software/S0351) can gather the username from the system.(Citation: Unit42 Cannon Nov 2018)","relationship_id":"relationship--47a31ea1-4b4d-4141-9d41-07d3b229913c","references":[{"source_name":"Unit42 Cannon Nov 2018","description":"Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"}]},{"id":"S0353","name":"NOKKI","url":"https://attack.mitre.org/software/S0353","kind":"malware","description":"[NOKKI](https://attack.mitre.org/software/S0353) can collect the username from the victim’s machine.(Citation: Unit 42 NOKKI Sept 2018)","relationship_id":"relationship--9e1daa60-db2d-4671-b96f-3ebebe1977cc","references":[{"source_name":"Unit 42 NOKKI Sept 2018","description":"Grunzweig, J., Lee, B. (2018, September 27). New KONNI Malware attacking Eurasia and Southeast Asia. Retrieved November 5, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/"}]},{"id":"S0354","name":"Denis","url":"https://attack.mitre.org/software/S0354","kind":"malware","description":"[Denis](https://attack.mitre.org/software/S0354) enumerates and collects the username from the victim’s machine.(Citation: Securelist Denis April 2017)(Citation: Cybereason Cobalt Kitty 2017)","relationship_id":"relationship--b47d8f5e-7c09-4f40-a5a8-ccce10a8363b","references":[{"source_name":"Securelist Denis April 2017","description":"Shulmin, A., Yunakovsky, S. (2017, April 28). Use of DNS Tunneling for C&C Communications. Retrieved November 5, 2018.","url":"https://securelist.com/use-of-dns-tunneling-for-cc-communications/78203/"},{"source_name":"Cybereason Cobalt Kitty 2017","description":"Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"id":"S0356","name":"KONNI","url":"https://attack.mitre.org/software/S0356","kind":"malware","description":"[KONNI](https://attack.mitre.org/software/S0356) can collect the username from the victim’s machine.(Citation: Talos Konni May 2017)","relationship_id":"relationship--412c7c8b-4821-4f08-a3d2-2da034f8343f","references":[{"source_name":"Talos Konni May 2017","description":"Rascagneres, P. (2017, May 03). KONNI: A Malware Under The Radar For Years. Retrieved November 5, 2018.","url":"https://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html"}]},{"id":"S0362","name":"Linux Rabbit","url":"https://attack.mitre.org/software/S0362","kind":"malware","description":"[Linux Rabbit](https://attack.mitre.org/software/S0362) opens a socket on port 22 and if it receives a response it attempts to obtain the machine's hostname and Top-Level Domain. (Citation: Anomali Linux Rabbit 2018)","relationship_id":"relationship--9613ad57-7f24-4dff-bea3-2626d8b2c335","references":[{"source_name":"Anomali Linux Rabbit 2018","description":"Anomali Labs. (2018, December 6). Pulling Linux Rabbit/Rabbot Malware Out of a Hat. Retrieved March 4, 2019.","url":"https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat"}]},{"id":"S0363","name":"Empire","url":"https://attack.mitre.org/software/S0363","kind":"tool","description":"[Empire](https://attack.mitre.org/software/S0363) can enumerate the username on targeted hosts.(Citation: Talos Frankenstein June 2019)","relationship_id":"relationship--f62b29cb-b483-41b3-9724-ab7a376dd2c6","references":[{"source_name":"Talos Frankenstein June 2019","description":"Adamitis, D. et al. (2019, June 4). It's alive: Threat actors cobble together open-source pieces into monstrous Frankenstein campaign. Retrieved May 11, 2020.","url":"https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html"}]},{"id":"S0367","name":"Emotet","url":"https://attack.mitre.org/software/S0367","kind":"malware","description":"[Emotet](https://attack.mitre.org/software/S0367) has enumerated all users connected to network shares.","relationship_id":"relationship--05e02170-dc4f-4112-a54c-fde4d05632d7","references":[]},{"id":"S0374","name":"SpeakUp","url":"https://attack.mitre.org/software/S0374","kind":"malware","description":"[SpeakUp](https://attack.mitre.org/software/S0374) uses the <code>whoami</code> command. (Citation: CheckPoint SpeakUp Feb 2019)","relationship_id":"relationship--375f92a4-13b2-4640-b192-c34eb2b91c9c","references":[{"source_name":"CheckPoint SpeakUp Feb 2019","description":"Check Point Research. (2019, February 4). SpeakUp: A New Undetected Backdoor Linux Trojan. Retrieved April 17, 2019.","url":"https://research.checkpoint.com/speakup-a-new-undetected-backdoor-linux-trojan/"}]},{"id":"S0379","name":"Revenge RAT","url":"https://attack.mitre.org/software/S0379","kind":"malware","description":"[Revenge RAT](https://attack.mitre.org/software/S0379) gathers the username from the system.(Citation: Cylance Shaheen Nov 2018)","relationship_id":"relationship--01c6d850-03c2-4ed0-ba1d-cf2cc9062106","references":[{"source_name":"Cylance Shaheen Nov 2018","description":"Livelli, K, et al. (2018, November 12). Operation Shaheen. Retrieved May 1, 2019.","url":"https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"}]},{"id":"S0381","name":"FlawedAmmyy","url":"https://attack.mitre.org/software/S0381","kind":"malware","description":"[FlawedAmmyy](https://attack.mitre.org/software/S0381) enumerates the current user during the initial infection.(Citation: Proofpoint TA505 Mar 2018)(Citation: Korean FSI TA505 2020)","relationship_id":"relationship--2b8418de-6474-49e2-84f0-01ffe6c07a42","references":[{"source_name":"Korean FSI TA505 2020","description":"Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="},{"source_name":"Proofpoint TA505 Mar 2018","description":"Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.","url":"https://www.proofpoint.com/us/threat-insight/post/leaked-ammyy-admin-source-code-turned-malware"}]},{"id":"S0382","name":"ServHelper","url":"https://attack.mitre.org/software/S0382","kind":"malware","description":"[ServHelper](https://attack.mitre.org/software/S0382) will attempt to enumerate the username of the victim.(Citation: Proofpoint TA505 Jan 2019)","relationship_id":"relationship--ab51438e-c79f-4fc5-b331-a85dc892b604","references":[{"source_name":"Proofpoint TA505 Jan 2019","description":"Schwarz, D. and Proofpoint Staff. (2019, January 9). ServHelper and FlawedGrace - New malware introduced by TA505. Retrieved May 28, 2019.","url":"https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505"}]},{"id":"S0385","name":"njRAT","url":"https://attack.mitre.org/software/S0385","kind":"malware","description":"[njRAT](https://attack.mitre.org/software/S0385) enumerates the current user during the initial infection.(Citation: Fidelis njRAT June 2013)","relationship_id":"relationship--8519b4c1-55c5-46be-8bdb-aa2a6ee2cb1a","references":[{"source_name":"Fidelis njRAT June 2013","description":"Fidelis Cybersecurity. (2013, June 28). Fidelis Threat Advisory #1009: \"njRAT\" Uncovered. Retrieved June 4, 2019.","url":"https://www.threatminer.org/_reports/2013/fta-1009---njrat-uncovered-1.pdf"}]},{"id":"S0391","name":"HAWKBALL","url":"https://attack.mitre.org/software/S0391","kind":"malware","description":"[HAWKBALL](https://attack.mitre.org/software/S0391) can collect the user name of the system.(Citation: FireEye HAWKBALL Jun 2019)","relationship_id":"relationship--6337062d-04c1-43df-a72b-8719a31102a0","references":[{"source_name":"FireEye HAWKBALL Jun 2019","description":"Patil, S. and Williams, M.. (2019, June 5). Government Sector in Central Asia Targeted With New HAWKBALL Backdoor Delivered via Microsoft Office Vulnerabilities. Retrieved June 20, 2019.","url":"https://www.fireeye.com/blog/threat-research/2019/06/government-in-central-asia-targeted-with-hawkball-backdoor.html"}]},{"id":"S0401","name":"Exaramel for Linux","url":"https://attack.mitre.org/software/S0401","kind":"malware","description":"[Exaramel for Linux](https://attack.mitre.org/software/S0401) can run <code>whoami</code> to identify the system owner.(Citation: ANSSI Sandworm January 2021)","relationship_id":"relationship--23f656c7-600f-46a7-8185-0edf45299bac","references":[{"source_name":"ANSSI Sandworm January 2021","description":"ANSSI. (2021, January 27). SANDWORM INTRUSION SET CAMPAIGN TARGETING CENTREON SYSTEMS. Retrieved March 30, 2021.","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"}]},{"id":"S0412","name":"ZxShell","url":"https://attack.mitre.org/software/S0412","kind":"malware","description":"[ZxShell](https://attack.mitre.org/software/S0412) can collect the owner and organization information from the target workstation.(Citation: Talos ZxShell Oct 2014) ","relationship_id":"relationship--6635f23e-99e9-4978-9924-ccf6c199f84f","references":[{"source_name":"Talos ZxShell Oct 2014","description":"Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.","url":"https://blogs.cisco.com/security/talos/opening-zxshell"}]},{"id":"S0414","name":"BabyShark","url":"https://attack.mitre.org/software/S0414","kind":"malware","description":"[BabyShark](https://attack.mitre.org/software/S0414) has executed the <code>whoami</code> command.(Citation: Unit42 BabyShark Feb 2019)","relationship_id":"relationship--09fbfb74-459a-441b-9e07-96c146a26be3","references":[{"source_name":"Unit42 BabyShark Feb 2019","description":"Unit 42. (2019, February 22). New BabyShark Malware Targets U.S. National Security Think Tanks. Retrieved October 7, 2019.","url":"https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"}]},{"id":"S0428","name":"PoetRAT","url":"https://attack.mitre.org/software/S0428","kind":"malware","description":"[PoetRAT](https://attack.mitre.org/software/S0428) sent username, computer name, and the previously generated UUID in reply to a \"who\" command from C2.(Citation: Talos PoetRAT April 2020)","relationship_id":"relationship--00e25bca-7df1-464e-94a4-cc13124e1d0c","references":[{"source_name":"Talos PoetRAT April 2020","description":"Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.","url":"https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html"}]},{"id":"S0431","name":"HotCroissant","url":"https://attack.mitre.org/software/S0431","kind":"malware","description":"[HotCroissant](https://attack.mitre.org/software/S0431) has the ability to collect the username on the infected host.(Citation: Carbon Black HotCroissant April 2020)","relationship_id":"relationship--c0f13745-074b-46ba-ae7a-03385ef79d31","references":[{"source_name":"Carbon Black HotCroissant April 2020","description":"Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020.","url":"https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"}]},{"id":"S0433","name":"Rifdoor","url":"https://attack.mitre.org/software/S0433","kind":"malware","description":"[Rifdoor](https://attack.mitre.org/software/S0433) has the ability to identify the username on the compromised host.(Citation: Carbon Black HotCroissant April 2020)","relationship_id":"relationship--8087182b-73c3-4efa-aad6-36498531f728","references":[{"source_name":"Carbon Black HotCroissant April 2020","description":"Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020.","url":"https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"}]},{"id":"S0439","name":"Okrum","url":"https://attack.mitre.org/software/S0439","kind":"malware","description":"[Okrum](https://attack.mitre.org/software/S0439) can collect the victim username.(Citation: ESET Okrum July 2019)","relationship_id":"relationship--6d8147e4-fca3-4348-9376-dd96cc7b9e30","references":[{"source_name":"ESET Okrum July 2019","description":"Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf"}]},{"id":"S0441","name":"PowerShower","url":"https://attack.mitre.org/software/S0441","kind":"malware","description":"[PowerShower](https://attack.mitre.org/software/S0441) has the ability to identify the current user on the infected host.(Citation: Kaspersky Cloud Atlas August 2019)","relationship_id":"relationship--c737cde1-271e-4f00-9692-3784e075c24d","references":[{"source_name":"Kaspersky Cloud Atlas August 2019","description":"GReAT. (2019, August 12). Recent Cloud Atlas activity. Retrieved May 8, 2020.","url":"https://securelist.com/recent-cloud-atlas-activity/92016/"}]},{"id":"S0447","name":"Lokibot","url":"https://attack.mitre.org/software/S0447","kind":"malware","description":"[Lokibot](https://attack.mitre.org/software/S0447) has the ability to discover the username on the infected host.(Citation: FSecure Lokibot November 2019)","relationship_id":"relationship--3ccef052-7ac9-47b1-9be6-8c140f279941","references":[{"source_name":"FSecure Lokibot November 2019","description":"Kazem, M. (2019, November 25). Trojan:W32/Lokibot. Retrieved May 15, 2020.","url":"https://www.f-secure.com/v-descs/trojan_w32_lokibot.shtml"}]},{"id":"S0448","name":"Rising Sun","url":"https://attack.mitre.org/software/S0448","kind":"malware","description":"[Rising Sun](https://attack.mitre.org/software/S0448) can detect the username of the infected host.(Citation: McAfee Sharpshooter December 2018)\t","relationship_id":"relationship--2d5c711d-dcd6-4d50-b91f-1fda5311eef5","references":[{"source_name":"McAfee Sharpshooter December 2018","description":"Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf"}]},{"id":"S0450","name":"SHARPSTATS","url":"https://attack.mitre.org/software/S0450","kind":"malware","description":"[SHARPSTATS](https://attack.mitre.org/software/S0450) has the ability to identify the username on the compromised host.(Citation: TrendMicro POWERSTATS V3 June 2019)","relationship_id":"relationship--f52cb753-6f2f-4f23-834a-75510e8fb47a","references":[{"source_name":"TrendMicro POWERSTATS V3 June 2019","description":"Lunghi, D. and Horejsi, J.. (2019, June 10). MuddyWater Resurfaces, Uses Multi-Stage Backdoor POWERSTATS V3 and New Post-Exploitation Tools. Retrieved May 14, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/muddywater-resurfaces-uses-multi-stage-backdoor-powerstats-v3-and-new-post-exploitation-tools/"}]},{"id":"S0455","name":"Metamorfo","url":"https://attack.mitre.org/software/S0455","kind":"malware","description":"[Metamorfo](https://attack.mitre.org/software/S0455) has collected the username from the victim's machine.(Citation: ESET Casbaneiro Oct 2019) ","relationship_id":"relationship--cea7b276-d2be-4af4-adaf-28eb26079098","references":[{"source_name":"ESET Casbaneiro Oct 2019","description":"ESET Research. (2019, October 3). Casbaneiro: peculiarities of this banking Trojan that affects Brazil and Mexico. Retrieved September 23, 2021.","url":"https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/"}]},{"id":"S0456","name":"Aria-body","url":"https://attack.mitre.org/software/S0456","kind":"malware","description":"[Aria-body](https://attack.mitre.org/software/S0456) has the ability to identify the username on a compromised host.(Citation: CheckPoint Naikon May 2020)","relationship_id":"relationship--549c2737-1097-4a16-8d4b-01ad0e3e689f","references":[{"source_name":"CheckPoint Naikon May 2020","description":"CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.","url":"https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"}]},{"id":"S0459","name":"MechaFlounder","url":"https://attack.mitre.org/software/S0459","kind":"malware","description":"[MechaFlounder](https://attack.mitre.org/software/S0459) has the ability to identify the username and hostname on a compromised host.(Citation: Unit 42 MechaFlounder March 2019)","relationship_id":"relationship--3ef224b5-2edf-41c1-916f-1d80a7dc4ada","references":[{"source_name":"Unit 42 MechaFlounder March 2019","description":"Falcone, R. (2019, March 4). New Python-Based Payload MechaFlounder Used by Chafer. Retrieved May 27, 2020.","url":"https://unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-used-by-chafer/"}]},{"id":"S0460","name":"Get2","url":"https://attack.mitre.org/software/S0460","kind":"malware","description":"[Get2](https://attack.mitre.org/software/S0460) has the ability to identify the current username of an infected host.(Citation: Proofpoint TA505 October 2019)","relationship_id":"relationship--d56e3076-7221-4e3b-8628-d8c50982892d","references":[{"source_name":"Proofpoint TA505 October 2019","description":"Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"}]},{"id":"S0461","name":"SDBbot","url":"https://attack.mitre.org/software/S0461","kind":"malware","description":"[SDBbot](https://attack.mitre.org/software/S0461) has the ability to identify the user on a compromised host.(Citation: Proofpoint TA505 October 2019)","relationship_id":"relationship--9ee385ef-7e78-47bf-be25-8ba112f9280e","references":[{"source_name":"Proofpoint TA505 October 2019","description":"Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"}]},{"id":"S0476","name":"Valak","url":"https://attack.mitre.org/software/S0476","kind":"malware","description":"[Valak](https://attack.mitre.org/software/S0476) can gather information regarding the user.(Citation: Cybereason Valak May 2020)","relationship_id":"relationship--5c46f9a0-fb83-473d-af9a-c1c98cfdd85b","references":[{"source_name":"Cybereason Valak May 2020","description":"Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020.","url":"https://www.cybereason.com/blog/valak-more-than-meets-the-eye"}]},{"id":"S0477","name":"Goopy","url":"https://attack.mitre.org/software/S0477","kind":"malware","description":"[Goopy](https://attack.mitre.org/software/S0477) has the ability to enumerate the infected system's user name.(Citation: Cybereason Cobalt Kitty 2017)","relationship_id":"relationship--80e484a4-e5b5-4de1-81c7-2bd1a927d156","references":[{"source_name":"Cybereason Cobalt Kitty 2017","description":"Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"id":"S0486","name":"Bonadan","url":"https://attack.mitre.org/software/S0486","kind":"malware","description":"[Bonadan](https://attack.mitre.org/software/S0486) has discovered the username of the user running the backdoor.(Citation: ESET ForSSHe December 2018)","relationship_id":"relationship--db5506f9-9451-471f-bb68-845c281be09c","references":[{"source_name":"ESET ForSSHe December 2018","description":"Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"}]},{"id":"S0498","name":"Cryptoistic","url":"https://attack.mitre.org/software/S0498","kind":"malware","description":"[Cryptoistic](https://attack.mitre.org/software/S0498) can gather data on the user of a compromised host.(Citation: SentinelOne Lazarus macOS July 2020)","relationship_id":"relationship--e3fe5089-90fc-47e6-afc7-fb0c41ba7c0c","references":[{"source_name":"SentinelOne Lazarus macOS July 2020","description":"Stokes, P. (2020, July 27). Four Distinct Families of Lazarus Malware Target Apple’s macOS Platform. Retrieved August 7, 2020.","url":"https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/"}]},{"id":"S0513","name":"LiteDuke","url":"https://attack.mitre.org/software/S0513","kind":"malware","description":"[LiteDuke](https://attack.mitre.org/software/S0513) can enumerate the account name on a targeted system.(Citation: ESET Dukes October 2019)","relationship_id":"relationship--d54e7a92-0601-4b77-8675-46e33b577b4d","references":[{"source_name":"ESET Dukes October 2019","description":"Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}]},{"id":"S0514","name":"WellMess","url":"https://attack.mitre.org/software/S0514","kind":"malware","description":"[WellMess](https://attack.mitre.org/software/S0514) can collect the username on the victim machine to send to C2.(Citation: CISA WellMess July 2020)","relationship_id":"relationship--0b126adc-3173-4751-978f-96b72913a346","references":[{"source_name":"CISA WellMess July 2020","description":"CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198b"}]},{"id":"S0515","name":"WellMail","url":"https://attack.mitre.org/software/S0515","kind":"malware","description":"[WellMail](https://attack.mitre.org/software/S0515) can identify the current username on the victim system.(Citation: CISA WellMail July 2020)","relationship_id":"relationship--731c3fa1-2af3-4b6e-ad0d-7942e8e966fb","references":[{"source_name":"CISA WellMail July 2020","description":"CISA. (2020, July 16). MAR-10296782-3.v1 – WELLMAIL. Retrieved September 29, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198c"}]},{"id":"S0521","name":"BloodHound","url":"https://attack.mitre.org/software/S0521","kind":"tool","description":"[BloodHound](https://attack.mitre.org/software/S0521) can collect information on user sessions.(Citation: CrowdStrike BloodHound April 2018)","relationship_id":"relationship--73717937-3d8f-402d-a222-b40d15a49cea","references":[{"source_name":"CrowdStrike BloodHound April 2018","description":"Red Team Labs. (2018, April 24). Hidden Administrative Accounts: BloodHound to the Rescue. Retrieved October 28, 2020.","url":"https://www.crowdstrike.com/blog/hidden-administrative-accounts-bloodhound-to-the-rescue/"}]},{"id":"S0531","name":"Grandoreiro","url":"https://attack.mitre.org/software/S0531","kind":"malware","description":"[Grandoreiro](https://attack.mitre.org/software/S0531) can collect the username from the victim's machine.(Citation: ESET Grandoreiro April 2020)","relationship_id":"relationship--57de7812-f3b0-44d1-9548-856a26278568","references":[{"source_name":"ESET Grandoreiro April 2020","description":"ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020.","url":"https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"}]},{"id":"S0532","name":"Lucifer","url":"https://attack.mitre.org/software/S0532","kind":"malware","description":"[Lucifer](https://attack.mitre.org/software/S0532) has the ability to identify the username on a compromised host.(Citation: Unit 42 Lucifer June 2020)","relationship_id":"relationship--42205acc-2d23-4ea9-ac29-980b6517d908","references":[{"source_name":"Unit 42 Lucifer June 2020","description":"Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.","url":"https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/"}]},{"id":"S0533","name":"SLOTHFULMEDIA","url":"https://attack.mitre.org/software/S0533","kind":"malware","description":"[SLOTHFULMEDIA](https://attack.mitre.org/software/S0533) has collected the username from a victim machine.(Citation: CISA MAR SLOTHFULMEDIA October 2020)","relationship_id":"relationship--4a7a38c4-fb6d-420e-ac37-0c774c7b3a9f","references":[{"source_name":"CISA MAR SLOTHFULMEDIA October 2020","description":"DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"}]},{"id":"S0534","name":"Bazar","url":"https://attack.mitre.org/software/S0534","kind":"malware","description":"[Bazar](https://attack.mitre.org/software/S0534) can identify the username of the infected user.(Citation: NCC Group Team9 June 2020)","relationship_id":"relationship--b609347d-0089-4021-86a6-706ef1abc95e","references":[{"source_name":"NCC Group Team9 June 2020","description":"Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.","url":"https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/"}]},{"id":"S0543","name":"Spark","url":"https://attack.mitre.org/software/S0543","kind":"malware","description":"[Spark](https://attack.mitre.org/software/S0543) has run the whoami command and has a built-in command to identify the user logged in.(Citation: Unit42 Molerat Mar 2020) ","relationship_id":"relationship--98f55ec9-3170-41ad-9bac-c921fa4a29ea","references":[{"source_name":"Unit42 Molerat Mar 2020","description":"Falcone, R., et al. (2020, March 3). Molerats Delivers Spark Backdoor to Government and Telecommunications Organizations. Retrieved December 14, 2020.","url":"https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/"}]},{"id":"S0554","name":"Egregor","url":"https://attack.mitre.org/software/S0554","kind":"malware","description":"[Egregor](https://attack.mitre.org/software/S0554) has used tools to gather information about users.(Citation: Intrinsec Egregor Nov 2020)","relationship_id":"relationship--830b40b0-ffc8-4847-8849-27b62c9e84b6","references":[{"source_name":"Intrinsec Egregor Nov 2020","description":"Bichet, J. (2020, November 12). Egregor – Prolock: Fraternal Twins ?. Retrieved January 6, 2021.","url":"https://www.intrinsec.com/egregor-prolock/?cn-reloaded=1"}]},{"id":"S0559","name":"SUNBURST","url":"https://attack.mitre.org/software/S0559","kind":"malware","description":"[SUNBURST](https://attack.mitre.org/software/S0559) collected the username from a compromised host.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Microsoft Analyzing Solorigate Dec 2020)","relationship_id":"relationship--d9089fda-0f17-43d2-bd5b-b9cd441bb4e2","references":[{"source_name":"FireEye SUNBURST Backdoor December 2020","description":"FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.","url":"https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"},{"source_name":"Microsoft Analyzing Solorigate Dec 2020","description":"MSTIC. (2020, December 18). Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers . Retrieved January 5, 2021.","url":"https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/"}]},{"id":"S0568","name":"EVILNUM","url":"https://attack.mitre.org/software/S0568","kind":"malware","description":"[EVILNUM](https://attack.mitre.org/software/S0568) can obtain the username from the victim's machine.(Citation: Prevailion EvilNum May 2020)","relationship_id":"relationship--b92d20d6-f6c3-4e5d-9f05-a06d45603617","references":[{"source_name":"Prevailion EvilNum May 2020","description":"Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20221209052853/https://www.prevailion.com/phantom-in-the-command-shell-2/"}]},{"id":"S0569","name":"Explosive","url":"https://attack.mitre.org/software/S0569","kind":"malware","description":"[Explosive](https://attack.mitre.org/software/S0569) has collected the username from the infected host.(Citation: CheckPoint Volatile Cedar March 2015) ","relationship_id":"relationship--6b1fd87c-b8d1-4ea1-9cc3-bc4fb1cd2fbd","references":[{"source_name":"CheckPoint Volatile Cedar March 2015","description":"Threat Intelligence and Research. (2015, March 30). VOLATILE CEDAR. Retrieved February 8, 2021.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-cedar-technical-report.pdf"}]},{"id":"S0572","name":"Caterpillar WebShell","url":"https://attack.mitre.org/software/S0572","kind":"malware","description":"[Caterpillar WebShell](https://attack.mitre.org/software/S0572) can obtain a list of user accounts from a victim's machine.(Citation: ClearSky Lebanese Cedar Jan 2021)","relationship_id":"relationship--c22f5416-2726-491e-ae10-35ec32ff9173","references":[{"source_name":"ClearSky Lebanese Cedar Jan 2021","description":"ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"}]},{"id":"S0590","name":"NBTscan","url":"https://attack.mitre.org/software/S0590","kind":"tool","description":"[NBTscan](https://attack.mitre.org/software/S0590) can list active users on the system.(Citation: Debian nbtscan Nov 2019)(Citation: SecTools nbtscan June 2003)\t","relationship_id":"relationship--06711c3f-230b-4d44-9c88-4861c48d2716","references":[{"source_name":"Debian nbtscan Nov 2019","description":"Bezroutchko, A. (2019, November 19). NBTscan man page. Retrieved March 17, 2021.","url":"https://manpages.debian.org/testing/nbtscan/nbtscan.1.en.html"},{"source_name":"SecTools nbtscan June 2003","description":"SecTools. (2003, June 11). NBTscan. Retrieved March 17, 2021.","url":"https://sectools.org/tool/nbtscan/"}]},{"id":"S0596","name":"ShadowPad","url":"https://attack.mitre.org/software/S0596","kind":"malware","description":"[ShadowPad](https://attack.mitre.org/software/S0596) has collected the username of the victim system.(Citation: Kaspersky ShadowPad Aug 2017)","relationship_id":"relationship--042001af-58f0-43c9-8747-5a0d0f7906f5","references":[{"source_name":"Kaspersky ShadowPad Aug 2017","description":"Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf"}]},{"id":"S0610","name":"SideTwist","url":"https://attack.mitre.org/software/S0610","kind":"malware","description":"[SideTwist](https://attack.mitre.org/software/S0610) can collect the username on a targeted system.(Citation: Check Point APT34 April 2021)","relationship_id":"relationship--36c4252b-fc24-467e-b56b-56ba29bb4026","references":[{"source_name":"Check Point APT34 April 2021","description":"Check Point. (2021, April 8). Iran’s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021.","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"}]},{"id":"S0615","name":"SombRAT","url":"https://attack.mitre.org/software/S0615","kind":"malware","description":"[SombRAT](https://attack.mitre.org/software/S0615) can execute <code>getinfo</code>  to identify the username on a compromised host.(Citation: BlackBerry CostaRicto November 2020)(Citation: CISA AR21-126A FIVEHANDS May 2021)","relationship_id":"relationship--70bed654-4c16-456a-8691-4f2bf1c916cc","references":[{"source_name":"BlackBerry CostaRicto November 2020","description":"The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"},{"source_name":"CISA AR21-126A FIVEHANDS May 2021","description":"CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"}]},{"id":"S0627","name":"SodaMaster","url":"https://attack.mitre.org/software/S0627","kind":"malware","description":"[SodaMaster](https://attack.mitre.org/software/S0627) can identify the username on a compromised host.(Citation: Securelist APT10 March 2021)","relationship_id":"relationship--4acb6288-8de5-4a5c-b7a4-68911ab148f9","references":[{"source_name":"Securelist APT10 March 2021","description":"GREAT. (2021, March 30). APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign. Retrieved June 17, 2021.","url":"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"}]},{"id":"S0631","name":"Chaes","url":"https://attack.mitre.org/software/S0631","kind":"malware","description":"[Chaes](https://attack.mitre.org/software/S0631) has collected the username and UID from the infected machine.(Citation: Cybereason Chaes Nov 2020)","relationship_id":"relationship--5bef7ca6-0d66-4d7c-9972-56781548222a","references":[{"source_name":"Cybereason Chaes Nov 2020","description":"Salem, E. (2020, November 17). CHAES: Novel Malware Targeting Latin American E-Commerce. Retrieved June 30, 2021.","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf"}]},{"id":"S0632","name":"GrimAgent","url":"https://attack.mitre.org/software/S0632","kind":"malware","description":"[GrimAgent](https://attack.mitre.org/software/S0632) can identify the user id on a target machine.(Citation: Group IB GrimAgent July 2021)","relationship_id":"relationship--38f5765d-0e42-4e63-9411-185983c6ca21","references":[{"source_name":"Group IB GrimAgent July 2021","description":"Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.","url":"https://www.group-ib.com/blog/grimagent/"}]},{"id":"S0635","name":"BoomBox","url":"https://attack.mitre.org/software/S0635","kind":"malware","description":"[BoomBox](https://attack.mitre.org/software/S0635) can enumerate the username on a compromised host.(Citation: MSTIC Nobelium Toolset May 2021)","relationship_id":"relationship--d1f2ae2f-66e2-4dff-a806-75097d6c9c19","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","description":"MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021.","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}]},{"id":"S0644","name":"ObliqueRAT","url":"https://attack.mitre.org/software/S0644","kind":"malware","description":"[ObliqueRAT](https://attack.mitre.org/software/S0644) can check for blocklisted usernames on infected endpoints.(Citation: Talos Oblique RAT March 2021)","relationship_id":"relationship--c7c2e904-7797-4d67-a0bf-dae4abf53689","references":[{"source_name":"Talos Oblique RAT March 2021","description":"Malhotra, A. (2021, March 2). ObliqueRAT returns with new campaign using hijacked websites. Retrieved September 2, 2021.","url":"https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html"}]},{"id":"S0647","name":"Turian","url":"https://attack.mitre.org/software/S0647","kind":"malware","description":"[Turian](https://attack.mitre.org/software/S0647) can retrieve usernames.(Citation: ESET BackdoorDiplomacy Jun 2021)","relationship_id":"relationship--4abb6550-b362-4f8a-80e4-1d6f094a1e37","references":[{"source_name":"ESET BackdoorDiplomacy Jun 2021","description":"Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"id":"S0649","name":"SMOKEDHAM","url":"https://attack.mitre.org/software/S0649","kind":"malware","description":"[SMOKEDHAM](https://attack.mitre.org/software/S0649) has used <code>whoami</code> commands to identify system owners.(Citation: FireEye SMOKEDHAM June 2021)","relationship_id":"relationship--8607f9cc-dd15-49a8-8e6a-55e1338591e9","references":[{"source_name":"FireEye SMOKEDHAM June 2021","description":"FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.","url":"https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html"}]},{"id":"S0650","name":"QakBot","url":"https://attack.mitre.org/software/S0650","kind":"malware","description":"[QakBot](https://attack.mitre.org/software/S0650) can identify the user name on a compromised system.(Citation: Kaspersky QakBot September 2021)(Citation: Trend Micro Black Basta October 2022)","relationship_id":"relationship--474912e8-0f81-439c-a613-51cbb9c0baa9","references":[{"source_name":"Trend Micro Black Basta October 2022","description":"Kenefick, I. et al. (2022, October 12). Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike. Retrieved February 6, 2023.","url":"https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html"},{"source_name":"Kaspersky QakBot September 2021","description":"Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021.","url":"https://securelist.com/qakbot-technical-analysis/103931/"}]},{"id":"S0652","name":"MarkiRAT","url":"https://attack.mitre.org/software/S0652","kind":"malware","description":"[MarkiRAT](https://attack.mitre.org/software/S0652) can retrieve the victim’s username.(Citation: Kaspersky Ferocious Kitten Jun 2021)","relationship_id":"relationship--17c50546-6ffb-462e-b4ec-2d7cd0b00f55","references":[{"source_name":"Kaspersky Ferocious Kitten Jun 2021","description":"GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}]},{"id":"S0657","name":"BLUELIGHT","url":"https://attack.mitre.org/software/S0657","kind":"malware","description":"[BLUELIGHT](https://attack.mitre.org/software/S0657) can collect the username on a compromised host.(Citation: Volexity InkySquid BLUELIGHT August 2021)","relationship_id":"relationship--0efb0490-9935-4d51-8b2f-974e090bbc10","references":[{"source_name":"Volexity InkySquid BLUELIGHT August 2021","description":"Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.","url":"https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"}]},{"id":"S0659","name":"Diavol","url":"https://attack.mitre.org/software/S0659","kind":"malware","description":"[Diavol](https://attack.mitre.org/software/S0659) can collect the username from a compromised host.(Citation: Fortinet Diavol July 2021)","relationship_id":"relationship--14e02371-ba11-459d-9662-188e85d3cf7c","references":[{"source_name":"Fortinet Diavol July 2021","description":"Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021.","url":"https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider"}]},{"id":"S0660","name":"Clambling","url":"https://attack.mitre.org/software/S0660","kind":"malware","description":"[Clambling](https://attack.mitre.org/software/S0660) can identify the username on a compromised host.(Citation: Trend Micro DRBControl February 2020)(Citation: Talent-Jump Clambling February 2020)","relationship_id":"relationship--dd06865b-d8fa-4626-8ebd-e75289377c4c","references":[{"source_name":"Trend Micro DRBControl February 2020","description":"Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"},{"source_name":"Talent-Jump Clambling February 2020","description":"Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.","url":"https://www.talent-jump.com/article/2020/02/17/CLAMBLING-A-New-Backdoor-Base-On-Dropbox-en/"}]},{"id":"S0662","name":"RCSession","url":"https://attack.mitre.org/software/S0662","kind":"malware","description":"[RCSession](https://attack.mitre.org/software/S0662) can gather system owner information, including user and administrator privileges.(Citation: Profero APT27 December 2020)","relationship_id":"relationship--89baa1ed-a6f9-4da6-9448-c74d8f8a638b","references":[{"source_name":"Profero APT27 December 2020","description":"Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.","url":"https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf"}]},{"id":"S0663","name":"SysUpdate","url":"https://attack.mitre.org/software/S0663","kind":"malware","description":"[SysUpdate](https://attack.mitre.org/software/S0663) can collect the username from a compromised host.(Citation: Lunghi Iron Tiger Linux)","relationship_id":"relationship--25b8811b-3e73-40c7-b1fc-132eeb5a6f5e","references":[{"source_name":"Lunghi Iron Tiger Linux","description":"Daniel Lunghi. (2023, March 1). Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting. Retrieved March 20, 2023.","url":"https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html"}]},{"id":"S0666","name":"Gelsemium","url":"https://attack.mitre.org/software/S0666","kind":"malware","description":"[Gelsemium](https://attack.mitre.org/software/S0666) has the ability to distinguish between a standard user and an administrator on a compromised host.(Citation: ESET Gelsemium June 2021)","relationship_id":"relationship--9718f2c1-99f3-4fa2-8293-44f2b30bba70","references":[{"source_name":"ESET Gelsemium June 2021","description":"Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}]},{"id":"S0667","name":"Chrommme","url":"https://attack.mitre.org/software/S0667","kind":"malware","description":"[Chrommme](https://attack.mitre.org/software/S0667) can retrieve the username from a targeted system.(Citation: ESET Gelsemium June 2021)","relationship_id":"relationship--e6e95c9e-0f7d-4611-a40a-95fd7ee9f206","references":[{"source_name":"ESET Gelsemium June 2021","description":"Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}]},{"id":"S0673","name":"DarkWatchman","url":"https://attack.mitre.org/software/S0673","kind":"malware","description":"[DarkWatchman](https://attack.mitre.org/software/S0673) has collected the username from a victim machine.(Citation: Prevailion DarkWatchman 2021)","relationship_id":"relationship--f3d2f8a8-da3a-4635-90e5-95f6fee86a9c","references":[{"source_name":"Prevailion DarkWatchman 2021","description":"Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.","url":"https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"}]},{"id":"S0680","name":"LitePower","url":"https://attack.mitre.org/software/S0680","kind":"malware","description":"[LitePower](https://attack.mitre.org/software/S0680) can determine if the current user has admin privileges.(Citation: Kaspersky WIRTE November 2021)","relationship_id":"relationship--32a62862-3dc9-4082-8570-d01abe25e00b","references":[{"source_name":"Kaspersky WIRTE November 2021","description":"Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.","url":"https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"}]},{"id":"S0681","name":"Lizar","url":"https://attack.mitre.org/software/S0681","kind":"malware","description":"[Lizar](https://attack.mitre.org/software/S0681) can collect the username from the system.(Citation: BiZone Lizar May 2021)(Citation: SekoiaBourhis_DiceLoader_Feb2024) ","relationship_id":"relationship--6f037ffb-3e85-41d0-8c48-ae36d0996d57","references":[{"source_name":"BiZone Lizar May 2021","description":"BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker’s toolkit. Retrieved February 2, 2022.","url":"https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"},{"source_name":"SekoiaBourhis_DiceLoader_Feb2024","description":"Bourhis, P., Sekoia TDR. (2024, February 1). Unveiling the intricacies of DiceLoader. Retrieved May 14, 2025.","url":"https://blog.sekoia.io/unveiling-the-intricacies-of-diceloader/"}]},{"id":"S0691","name":"Neoichor","url":"https://attack.mitre.org/software/S0691","kind":"malware","description":"[Neoichor](https://attack.mitre.org/software/S0691) can collect the user name from a victim's machine.(Citation: Microsoft NICKEL December 2021)","relationship_id":"relationship--80a8ee57-3169-4928-aa94-56d356b72931","references":[{"source_name":"Microsoft NICKEL December 2021","description":"MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022.","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"id":"S0692","name":"SILENTTRINITY","url":"https://attack.mitre.org/software/S0692","kind":"tool","description":"[SILENTTRINITY](https://attack.mitre.org/software/S0692) can gather a list of logged on users.(Citation: GitHub SILENTTRINITY Modules July 2019) ","relationship_id":"relationship--ec6dc634-8214-4817-aabb-30ffb19ad4cc","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","description":"Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}]},{"id":"S0694","name":"DRATzarus","url":"https://attack.mitre.org/software/S0694","kind":"malware","description":"[DRATzarus](https://attack.mitre.org/software/S0694) can obtain a list of users from an infected machine.(Citation: ClearSky Lazarus Aug 2020)","relationship_id":"relationship--022ba33a-16f4-40de-b0b2-4961870aa0c9","references":[{"source_name":"ClearSky Lazarus Aug 2020","description":"ClearSky Research Team. (2020, August 13). Operation 'Dream Job' Widespread North Korean Espionage Campaign. Retrieved December 20, 2021.","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"}]},{"id":"S0696","name":"Flagpro","url":"https://attack.mitre.org/software/S0696","kind":"malware","description":"[Flagpro](https://attack.mitre.org/software/S0696) has been used to run the <code>whoami</code> command on the system.(Citation: NTT Security Flagpro new December 2021)","relationship_id":"relationship--a0b16d25-48f0-42e5-be32-8b831e18c869","references":[{"source_name":"NTT Security Flagpro new December 2021","description":"Hada, H. (2021, December 28).  Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.","url":"https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech"}]},{"id":"S1013","name":"ZxxZ","url":"https://attack.mitre.org/software/S1013","kind":"malware","description":"[ZxxZ](https://attack.mitre.org/software/S1013) can collect the username from a compromised host.(Citation: Cisco Talos Bitter Bangladesh May 2022)","relationship_id":"relationship--d979c181-32f5-4977-8ca9-30a1edc595c0","references":[{"source_name":"Cisco Talos Bitter Bangladesh May 2022","description":"Raghuprasad, C . (2022, May 11). Bitter APT adds Bangladesh to their targets. Retrieved June 1, 2022.","url":"https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"}]},{"id":"S1015","name":"Milan","url":"https://attack.mitre.org/software/S1015","kind":"malware","description":"[Milan](https://attack.mitre.org/software/S1015) can identify users registered to a targeted machine.(Citation: ClearSky Siamesekitten August 2021)","relationship_id":"relationship--4579695f-22c6-4391-a508-da942c2e0570","references":[{"source_name":"ClearSky Siamesekitten August 2021","description":"ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.","url":"https://www.clearskysec.com/siamesekitten/"}]},{"id":"S1016","name":"MacMa","url":"https://attack.mitre.org/software/S1016","kind":"malware","description":"[MacMa](https://attack.mitre.org/software/S1016) can collect the username from the compromised machine.(Citation: ESET DazzleSpy Jan 2022)","relationship_id":"relationship--0bf4ebc1-e4e4-4d56-8380-cb9601de353f","references":[{"source_name":"ESET DazzleSpy Jan 2022","description":"M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.","url":"https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"}]},{"id":"S1018","name":"Saint Bot","url":"https://attack.mitre.org/software/S1018","kind":"malware","description":"[Saint Bot](https://attack.mitre.org/software/S1018) can collect the username from a compromised host.(Citation: Malwarebytes Saint Bot April 2021)","relationship_id":"relationship--e0566454-eca2-4623-9366-87827c0d3f1b","references":[{"source_name":"Malwarebytes Saint Bot April 2021","description":"Hasherezade. (2021, April 6). A deep dive into Saint Bot, a new downloader. Retrieved June 9, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/"}]},{"id":"S1021","name":"DnsSystem","url":"https://attack.mitre.org/software/S1021","kind":"malware","description":"[DnsSystem](https://attack.mitre.org/software/S1021) can use the Windows user name to create a unique identification for infected users and systems.(Citation: Zscaler Lyceum DnsSystem June 2022)","relationship_id":"relationship--8f9cee62-46ce-4ede-a478-6002962528a7","references":[{"source_name":"Zscaler Lyceum DnsSystem June 2022","description":"Shivtarkar, N. and Kumar, A. (2022, June 9). Lyceum .NET DNS Backdoor. Retrieved June 23, 2022.","url":"https://www.zscaler.com/blogs/security-research/lyceum-net-dns-backdoor"}]},{"id":"S1024","name":"CreepySnail","url":"https://attack.mitre.org/software/S1024","kind":"malware","description":"[CreepySnail](https://attack.mitre.org/software/S1024) can execute `getUsername` on compromised systems.(Citation: Microsoft POLONIUM June 2022)","relationship_id":"relationship--f130830a-f796-43a0-8415-58ad2b3aae63","references":[{"source_name":"Microsoft POLONIUM June 2022","description":"Microsoft. (2022, June 2). Exposing POLONIUM activity and infrastructure targeting Israeli organizations. Retrieved July 1, 2022.","url":"https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"}]},{"id":"S1025","name":"Amadey","url":"https://attack.mitre.org/software/S1025","kind":"malware","description":"[Amadey](https://attack.mitre.org/software/S1025) has collected the user name from a compromised host using `GetUserNameA`.(Citation: BlackBerry Amadey 2020)","relationship_id":"relationship--d9a670e7-9076-4a4f-8861-981bb04b946f","references":[{"source_name":"BlackBerry Amadey 2020","description":"Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.","url":"https://blogs.blackberry.com/en/2020/01/threat-spotlight-amadey-bot"}]},{"id":"S1028","name":"Action RAT","url":"https://attack.mitre.org/software/S1028","kind":"malware","description":" [Action RAT](https://attack.mitre.org/software/S1028) has the ability to collect the username from an infected host.(Citation: MalwareBytes SideCopy Dec 2021)","relationship_id":"relationship--e4960a7a-c280-4356-8b03-b848c68acd05","references":[{"source_name":"MalwareBytes SideCopy Dec 2021","description":"Threat Intelligence Team. (2021, December 2). SideCopy APT: Connecting lures victims, payloads to infrastructure. Retrieved June 13, 2022.","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"id":"S1029","name":"AuTo Stealer","url":"https://attack.mitre.org/software/S1029","kind":"malware","description":"[AuTo Stealer](https://attack.mitre.org/software/S1029) has the ability to collect the username from an infected host.(Citation: MalwareBytes SideCopy Dec 2021)","relationship_id":"relationship--1f5efc33-a643-4f9b-aae9-6c59208ff790","references":[{"source_name":"MalwareBytes SideCopy Dec 2021","description":"Threat Intelligence Team. (2021, December 2). SideCopy APT: Connecting lures victims, payloads to infrastructure. Retrieved June 13, 2022.","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"id":"S1030","name":"Squirrelwaffle","url":"https://attack.mitre.org/software/S1030","kind":"malware","description":"[Squirrelwaffle](https://attack.mitre.org/software/S1030) can collect the user name from a compromised host.(Citation: ZScaler Squirrelwaffle Sep 2021)","relationship_id":"relationship--044576aa-2ec0-4f88-9cb9-ec6817dda514","references":[{"source_name":"ZScaler Squirrelwaffle Sep 2021","description":"Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.","url":"https://www.zscaler.com/blogs/security-research/squirrelwaffle-new-loader-delivering-cobalt-strike"}]},{"id":"S1032","name":"PyDCrypt","url":"https://attack.mitre.org/software/S1032","kind":"malware","description":"[PyDCrypt](https://attack.mitre.org/software/S1032) has probed victim machines with <code>whoami</code> and has collected the username from the machine.(Citation: Checkpoint MosesStaff Nov 2021)","relationship_id":"relationship--c5540ad5-b651-498f-abd4-fe521f1288f9","references":[{"source_name":"Checkpoint MosesStaff Nov 2021","description":"Checkpoint Research. (2021, November 15). Uncovering MosesStaff techniques: Ideology over Money. Retrieved August 11, 2022.","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}]},{"id":"S1034","name":"StrifeWater","url":"https://attack.mitre.org/software/S1034","kind":"malware","description":"[StrifeWater](https://attack.mitre.org/software/S1034) can collect the user name from the victim's machine.(Citation: Cybereason StrifeWater Feb 2022)","relationship_id":"relationship--1218d239-d7ee-44ba-a88d-6b76cb16324e","references":[{"source_name":"Cybereason StrifeWater Feb 2022","description":"Cybereason Nocturnus. (2022, February 1). StrifeWater RAT: Iranian APT Moses Staff Adds New Trojan to Ransomware Operations. Retrieved August 15, 2022.","url":"https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations"}]},{"id":"S1035","name":"Small Sieve","url":"https://attack.mitre.org/software/S1035","kind":"malware","description":"[Small Sieve](https://attack.mitre.org/software/S1035) can obtain the id of a logged in user.(Citation: NCSC GCHQ Small Sieve Jan 2022)","relationship_id":"relationship--82927a23-3e5e-4892-b788-c35cc6e649a5","references":[{"source_name":"NCSC GCHQ Small Sieve Jan 2022","description":"NCSC GCHQ. (2022, January 27). Small Sieve Malware Analysis Report. Retrieved August 22, 2022.","url":"https://www.ncsc.gov.uk/files/NCSC-Malware-Analysis-Report-Small-Sieve.pdf"}]},{"id":"S1037","name":"STARWHALE","url":"https://attack.mitre.org/software/S1037","kind":"malware","description":"[STARWHALE](https://attack.mitre.org/software/S1037) can gather the username from an infected host.(Citation: Mandiant UNC3313 Feb 2022)(Citation: DHS CISA AA22-055A MuddyWater February 2022) ","relationship_id":"relationship--7ed13f1b-fa49-4b4e-9bc8-935012710d5f","references":[{"source_name":"DHS CISA AA22-055A MuddyWater February 2022","description":"FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"},{"source_name":"Mandiant UNC3313 Feb 2022","description":"Tomcik, R. et al. (2022, February 24). Left On Read: Telegram Malware Spotted in Latest Iranian Cyber Espionage Activity. Retrieved August 18, 2022.","url":"https://www.mandiant.com/resources/telegram-malware-iranian-espionage"}]},{"id":"S1039","name":"Bumblebee","url":"https://attack.mitre.org/software/S1039","kind":"malware","description":"[Bumblebee](https://attack.mitre.org/software/S1039) has the ability to identify the user name.(Citation: Google EXOTIC LILY March 2022)","relationship_id":"relationship--128eeb8d-c492-4dbf-a423-0b68a4b53443","references":[{"source_name":"Google EXOTIC LILY March 2022","description":"Stolyarov, V. (2022, March 17). Exposing initial access broker with ties to Conti. Retrieved August 18, 2022.","url":"https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"}]},{"id":"S1044","name":"FunnyDream","url":"https://attack.mitre.org/software/S1044","kind":"malware","description":"[FunnyDream](https://attack.mitre.org/software/S1044) has the ability to gather user information from the targeted system using `whoami/upn&whoami/fqdn&whoami/logonid&whoami/all`.(Citation: Bitdefender FunnyDream Campaign November 2020)","relationship_id":"relationship--82404260-b720-4f23-a162-81a9d6735c1e","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}]},{"id":"S1059","name":"metaMain","url":"https://attack.mitre.org/software/S1059","kind":"malware","description":"[metaMain](https://attack.mitre.org/software/S1059) can collect the username from a compromised host.(Citation: SentinelLabs Metador Technical Appendix Sept 2022)","relationship_id":"relationship--1dfbbbe3-c04d-4ad6-98bf-15a9cd84ab06","references":[{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","description":"SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}]},{"id":"S1060","name":"Mafalda","url":"https://attack.mitre.org/software/S1060","kind":"malware","description":"[Mafalda](https://attack.mitre.org/software/S1060) can collect the username from a compromised host.(Citation: SentinelLabs Metador Technical Appendix Sept 2022)","relationship_id":"relationship--a3849766-140d-4dc0-86ca-1e3ad38c15b5","references":[{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","description":"SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}]},{"id":"S1064","name":"SVCReady","url":"https://attack.mitre.org/software/S1064","kind":"malware","description":"[SVCReady](https://attack.mitre.org/software/S1064) can collect the username from an infected host.(Citation: HP SVCReady Jun 2022)","relationship_id":"relationship--6cd6dc77-210e-41d7-b534-88d5c21e6a9b","references":[{"source_name":"HP SVCReady Jun 2022","description":"Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.","url":"https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/"}]},{"id":"S1065","name":"Woody RAT","url":"https://attack.mitre.org/software/S1065","kind":"malware","description":"[Woody RAT](https://attack.mitre.org/software/S1065) can retrieve a list of user accounts and usernames from an infected machine.(Citation: MalwareBytes WoodyRAT Aug 2022)","relationship_id":"relationship--147cd553-fd25-46ea-83ed-594cdb82c440","references":[{"source_name":"MalwareBytes WoodyRAT Aug 2022","description":"MalwareBytes Threat Intelligence Team. (2022, August 3). Woody RAT: A new feature-rich malware spotted in the wild. Retrieved December 6, 2022.","url":"https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"}]},{"id":"S1068","name":"BlackCat","url":"https://attack.mitre.org/software/S1068","kind":"malware","description":"[BlackCat](https://attack.mitre.org/software/S1068) can utilize `net use` commands to discover the user name on a compromised host.(Citation: Microsoft BlackCat Jun 2022)","relationship_id":"relationship--f8c2b8e1-7439-48df-a8c3-6796fd4bb142","references":[{"source_name":"Microsoft BlackCat Jun 2022","description":"Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.","url":"https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"}]},{"id":"S1075","name":"KOPILUWAK","url":"https://attack.mitre.org/software/S1075","kind":"malware","description":"[KOPILUWAK](https://attack.mitre.org/software/S1075) can conduct basic network reconnaissance on the victim machine with `whoami`, to get user details.(Citation: Mandiant Suspected Turla Campaign February 2023)","relationship_id":"relationship--f778e7e2-6119-4417-9f30-dfce65f6afe9","references":[{"source_name":"Mandiant Suspected Turla Campaign February 2023","description":"Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023.","url":"https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"}]},{"id":"S1081","name":"BADHATCH","url":"https://attack.mitre.org/software/S1081","kind":"malware","description":"[BADHATCH](https://attack.mitre.org/software/S1081) can obtain logged user information from a compromised machine and can execute the command `whoami.exe`.(Citation: BitDefender BADHATCH Mar 2021)","relationship_id":"relationship--5ea72071-0251-4826-8a7b-7677ec52eadb","references":[{"source_name":"BitDefender BADHATCH Mar 2021","description":"Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"}]},{"id":"S1087","name":"AsyncRAT","url":"https://attack.mitre.org/software/S1087","kind":"tool","description":"[AsyncRAT](https://attack.mitre.org/software/S1087) can check if the current user of a compromised system is an administrator. (Citation: Telefonica Snip3 December 2021)","relationship_id":"relationship--57851829-665d-4871-9327-1734547f7d9d","references":[{"source_name":"Telefonica Snip3 December 2021","description":"Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.","url":"https://telefonicatech.com/blog/snip3-investigacion-malware"}]},{"id":"S1106","name":"NGLite","url":"https://attack.mitre.org/software/S1106","kind":"malware","description":"[NGLite](https://attack.mitre.org/software/S1106) will run the <code>whoami</code> command to gather system information and return this to the command and control server.(Citation: NGLite Trojan)","relationship_id":"relationship--8a0ac9c9-e8e2-44a2-b2b0-87b4b4fa90fb","references":[{"source_name":"NGLite Trojan","description":"Robert Falcone, Jeff White, and Peter Renals. (2021, November 7). Targeted Attack Campaign Against ManageEngine ADSelfService Plus Delivers Godzilla Webshells, NGLite Trojan and KdcSponge Stealer. Retrieved February 8, 2024.","url":"https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/"}]},{"id":"S1124","name":"SocGholish","url":"https://attack.mitre.org/software/S1124","kind":"malware","description":"[SocGholish](https://attack.mitre.org/software/S1124) can use `whoami` to obtain the username from a compromised host.(Citation: SocGholish-update)(Citation: Red Canary SocGholish March 2024)(Citation: Secureworks Gold Prelude Profile)","relationship_id":"relationship--8c5c3632-2327-4ff2-ada8-25036a19b85a","references":[{"source_name":"SocGholish-update","description":"Andrew Northern. (2022, November 22). SocGholish, a very real threat from a very fake update. Retrieved February 13, 2024.","url":"https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"},{"source_name":"Red Canary SocGholish March 2024","description":"Red Canary. (2024, March). Red Canary 2024 Threat Detection Report: SocGholish. Retrieved March 22, 2024.","url":"https://redcanary.com/threat-detection-report/threats/socgholish/"},{"source_name":"Secureworks Gold Prelude Profile","description":"Secureworks. (n.d.). GOLD PRELUDE . Retrieved March 22, 2024.","url":"https://www.secureworks.com/research/threat-profiles/gold-prelude"}]},{"id":"S1130","name":"Raspberry Robin","url":"https://attack.mitre.org/software/S1130","kind":"malware","description":"[Raspberry Robin](https://attack.mitre.org/software/S1130) determines whether it is successfully running on a victim system by querying the running account information to determine if it is running in Session 0, indicating running with elevated privileges.(Citation: TrendMicro RaspberryRobin 2022)","relationship_id":"relationship--4dfbd868-5ab0-47c9-822e-a20db55dced5","references":[{"source_name":"TrendMicro RaspberryRobin 2022","description":"Christopher So. (2022, December 20). Raspberry Robin Malware Targets Telecom, Governments. Retrieved May 17, 2024.","url":"https://www.trendmicro.com/en_us/research/22/l/raspberry-robin-malware-targets-telecom-governments.html"}]},{"id":"S1141","name":"LunarWeb","url":"https://attack.mitre.org/software/S1141","kind":"malware","description":"[LunarWeb](https://attack.mitre.org/software/S1141) can collect user information from the targeted host.(Citation: ESET Turla Lunar toolset May 2024)","relationship_id":"relationship--e9bdf74e-3f6c-4097-9465-ec0b255326e4","references":[{"source_name":"ESET Turla Lunar toolset May 2024","description":"Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}]},{"id":"S1146","name":"MgBot","url":"https://attack.mitre.org/software/S1146","kind":"malware","description":"[MgBot](https://attack.mitre.org/software/S1146) includes modules for identifying local users and administrators on victim machines.(Citation: Symantec Daggerfly 2023)","relationship_id":"relationship--118542b5-248a-475d-9eae-78efa872b399","references":[{"source_name":"Symantec Daggerfly 2023","description":"Threat Hunter Team. (2023, April 20). Daggerfly: APT Actor Targets Telecoms Company in Africa. Retrieved July 25, 2024.","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"}]},{"id":"S1147","name":"Nightdoor","url":"https://attack.mitre.org/software/S1147","kind":"malware","description":"[Nightdoor](https://attack.mitre.org/software/S1147) gathers information on victim system users and usernames.(Citation: ESET EvasivePanda 2024)","relationship_id":"relationship--ddd70255-e5c4-4812-93e5-a20cdf993330","references":[{"source_name":"ESET EvasivePanda 2024","description":"Ahn Ho, Facundo Muñoz, & Marc-Etienne M.Léveillé. (2024, March 7). Evasive Panda leverages Monlam Festival to target Tibetans. Retrieved July 25, 2024.","url":"https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"}]},{"id":"S1148","name":"Raccoon Stealer","url":"https://attack.mitre.org/software/S1148","kind":"malware","description":"[Raccoon Stealer](https://attack.mitre.org/software/S1148) gathers information on the infected system owner and user.(Citation: S2W Racoon 2022)(Citation: Sekoia Raccoon1 2022)(Citation: Sekoia Raccoon2 2022)","relationship_id":"relationship--1deaad9b-3a33-421b-b13b-6dcad02707cf","references":[{"source_name":"Sekoia Raccoon2 2022","description":"Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.","url":"https://blog.sekoia.io/raccoon-stealer-v2-part-2-in-depth-analysis/"},{"source_name":"Sekoia Raccoon1 2022","description":"Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.","url":"https://blog.sekoia.io/raccoon-stealer-v2-part-1-the-return-of-the-dead/"},{"source_name":"S2W Racoon 2022","description":"S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.","url":"https://medium.com/s2wblog/raccoon-stealer-is-back-with-a-new-version-5f436e04b20d"}]},{"id":"S1149","name":"CHIMNEYSWEEP","url":"https://attack.mitre.org/software/S1149","kind":"malware","description":"[CHIMNEYSWEEP](https://attack.mitre.org/software/S1149) has included the victim's computer name and username in C2 messages sent to actor-owned infrastructure.(Citation: Mandiant ROADSWEEP August 2022)","relationship_id":"relationship--81cb331d-a24d-4100-a26a-447b0dc73260","references":[{"source_name":"Mandiant ROADSWEEP August 2022","description":"Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}]},{"id":"S1153","name":"Cuckoo Stealer","url":"https://attack.mitre.org/software/S1153","kind":"malware","description":"[Cuckoo Stealer](https://attack.mitre.org/software/S1153) can discover and send the username from a compromised host to C2.(Citation: Kandji Cuckoo April 2024)","relationship_id":"relationship--1336d5a0-f7b3-4d5c-a89b-afdbf1b5e3a8","references":[{"source_name":"Kandji Cuckoo April 2024","description":"Kohler, A. and Lopez, C. (2024, April 30). Malware: Cuckoo Behaves Like Cross Between Infostealer and Spyware. Retrieved August 20, 2024.","url":"https://www.kandji.io/blog/malware-cuckoo-infostealer-spyware"}]},{"id":"S1160","name":"Latrodectus","url":"https://attack.mitre.org/software/S1160","kind":"malware","description":"[Latrodectus](https://attack.mitre.org/software/S1160) can discover the username of an infected host.(Citation: Elastic Latrodectus May 2024)","relationship_id":"relationship--2fd0ebb0-6086-441d-b83c-e73e3f8ed69a","references":[{"source_name":"Elastic Latrodectus May 2024","description":"Stepanic, D. and Bousseaden, S. (2024, May 15). Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID. Retrieved September 13, 2024.","url":"https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"}]},{"id":"S1169","name":"Mango","url":"https://attack.mitre.org/software/S1169","kind":"malware","description":"[Mango](https://attack.mitre.org/software/S1169) can collect the user name from a compromised system which is used to create a unique victim identifier.(Citation: ESET OilRig Campaigns Sep 2023)","relationship_id":"relationship--aec8c69a-43f1-45e3-a7de-d2fa2ca7550e","references":[{"source_name":"ESET OilRig Campaigns Sep 2023","description":"Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.","url":"https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"}]},{"id":"S1172","name":"OilBooster","url":"https://attack.mitre.org/software/S1172","kind":"malware","description":"[OilBooster](https://attack.mitre.org/software/S1172) can identify the compromised system's username which is then used as part of a unique identifier.(Citation: ESET OilRig Downloaders DEC 2023)","relationship_id":"relationship--d5f4de59-e743-4330-98a5-7240b8103f44","references":[{"source_name":"ESET OilRig Downloaders DEC 2023","description":"Hromcova, Z. and Burgher, A. (2023, December 14). OilRig’s persistent attacks using cloud service-powered downloaders. Retrieved November 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"}]},{"id":"S1207","name":"XLoader","url":"https://attack.mitre.org/software/S1207","kind":"malware","description":"[XLoader](https://attack.mitre.org/software/S1207) can identify the username from a victim machine.(Citation: Acronis XLoader 2021)","relationship_id":"relationship--cc2fed0b-69f2-4328-9236-02d4213dbbe7","references":[{"source_name":"Acronis XLoader 2021","description":"Acronis. (2021, November 26). Trojan-as-a-service: From Formbook to XLoader. Retrieved March 11, 2025.","url":"https://www.acronis.com/en-us/cyber-protection-center/posts/trojan-as-a-service-from-formbook-to-xloader/"}]},{"id":"S1226","name":"BOOKWORM","url":"https://attack.mitre.org/software/S1226","kind":"malware","description":"[BOOKWORM](https://attack.mitre.org/software/S1226) has obtained the username from an infected host. (Citation: Unit42 Bookworm Nov2015)","relationship_id":"relationship--09b8bc73-f318-4ff8-a7f1-2c1649df1186","references":[{"source_name":"Unit42 Bookworm Nov2015","description":"Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.","url":"https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"}]},{"id":"S1228","name":"PUBLOAD","url":"https://attack.mitre.org/software/S1228","kind":"malware","description":"[PUBLOAD](https://attack.mitre.org/software/S1228) has obtained the username from an infected host.(Citation: Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022)(Citation: CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024)(Citation: 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA)(Citation: 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload)","relationship_id":"relationship--22e70d45-8ca7-4a05-a22a-ffd5ffdd5f61","references":[{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","description":"Asheer Malhotra, Jungsoo An, Kendall Mc. (2022, May 5). Mustang Panda deploys a new wave of malware targeting Europe. Retrieved August 4, 2025.","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source_name":"CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024","description":"CSIRT CTI. (2024, January 23). Stately Taurus Targets Myanmar Amidst Concerns over Military Junta’s Handling of Rebel Attacks. Retrieved August 4, 2025.","url":"https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"},{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","description":"Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","description":"Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"}]},{"id":"S1229","name":"Havoc","url":"https://attack.mitre.org/software/S1229","kind":"malware","description":"[Havoc](https://attack.mitre.org/software/S1229) can trigger exection of `whoami` on the target host to display the current user.(Citation: Zscaler Havoc FEB 2023)(Citation: Fortinet Havoc MAR 2025)","relationship_id":"relationship--19ff1c1a-cd11-454f-b905-16657eb866d6","references":[{"source_name":"Zscaler Havoc FEB 2023","description":"Shivtarkar, N. and Jain, S. (2023, February 14). Havoc Across the Cyberspace. Retrieved August 4, 2025.","url":"https://www.zscaler.com/blogs/security-research/havoc-across-cyberspace"},{"source_name":"Fortinet Havoc MAR 2025","description":"Wan, Y. (2025, March 3). Havoc: SharePoint with Microsoft Graph API turns into FUD C2. Retrieved August 4, 2025.","url":"https://www.fortinet.com/blog/threat-research/havoc-sharepoint-with-microsoft-graph-api-turns-into-fud-c2"}]},{"id":"S1239","name":"TONESHELL","url":"https://attack.mitre.org/software/S1239","kind":"malware","description":"[TONESHELL](https://attack.mitre.org/software/S1239) has obtained the username from an infected host.(Citation: 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload)","relationship_id":"relationship--d3272553-9c28-47af-b2ae-9f675a5eaade","references":[{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","description":"Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"}]},{"id":"S1240","name":"RedLine Stealer","url":"https://attack.mitre.org/software/S1240","kind":"malware","description":"[RedLine Stealer](https://attack.mitre.org/software/S1240) has obtained the username from the victim’s machine.(Citation: Proofpoint RedLine Stealer March 2020)(Citation: Splunk RedLine Stealer June 2023)(Citation: Veriti RedLine Stealer MAAS April 2023)","relationship_id":"relationship--242af6ac-a8f9-44fd-ae3f-edd975b37b4c","references":[{"source_name":"Proofpoint RedLine Stealer March 2020","description":"Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.","url":"https://www.proofpoint.com/us/blog/threat-insight/new-redline-stealer-distributed-using-coronavirus-themed-email-campaign"},{"source_name":"Splunk RedLine Stealer June 2023","description":"Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.","url":"https://www.splunk.com/en_us/blog/security/do-not-cross-the-redline-stealer-detections-and-analysis.html"},{"source_name":"Veriti RedLine Stealer MAAS April 2023","description":"Yair Herling. (2023, April 4). From ChatGPT to RedLine Stealer: The Dark Side of OpenAI and Google Bard. Retrieved September 17, 2025.","url":"https://veriti.ai/blog/veriti-research/from-chatgpt-to-redline-stealer-the-dark-side-of-openai-and-google-bard/"}]},{"id":"S1245","name":"InvisibleFerret","url":"https://attack.mitre.org/software/S1245","kind":"malware","description":"[InvisibleFerret](https://attack.mitre.org/software/S1245) has identified the user’s UUID and username through the \"pay\" module.(Citation: Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023) ","relationship_id":"relationship--9bcb35a2-ac15-4a8f-a9cf-0978e44d5d17","references":[{"source_name":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","description":"eSentire Threat Response Unit (TRU). (2024, November 14). Bored BeaverTail & InvisibleFerret Yacht Club – A Lazarus Lure Pt.2. Retrieved October 17, 2025.","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","description":"Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025.","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","description":"Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025.","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"}]},{"id":"S1248","name":"XORIndex Loader","url":"https://attack.mitre.org/software/S1248","kind":"malware","description":"[XORIndex Loader](https://attack.mitre.org/software/S1248) has collected the username from the victim host.(Citation: Socket BeaverTail XORIndex HexEval Contagious Interview July 2025)","relationship_id":"relationship--ed531ef0-02be-478d-811a-7c0e5643ac06","references":[{"source_name":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","description":"Kirill Boychenko. (2025, July 14). Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader. Retrieved October 19, 2025.","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"}]},{"id":"S1249","name":"HexEval Loader","url":"https://attack.mitre.org/software/S1249","kind":"malware","description":"[HexEval Loader](https://attack.mitre.org/software/S1249) has collected the username from the victim host.(Citation: Socket HexEval BeaverTail Contagious Interview June 2025)","relationship_id":"relationship--adba082d-7e17-44a4-82fb-c2d35997724b","references":[{"source_name":"Socket HexEval BeaverTail Contagious Interview June 2025","description":"Kirill Boychenko. (2025, June 25). Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages. Retrieved October 19, 2025.","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"}]},{"id":"S9019","name":"PureCrypter","url":"https://attack.mitre.org/software/S9019","kind":"malware","description":"[PureCrypter](https://attack.mitre.org/software/S9019) can retrieve the username from targeted machines.(Citation: Check Point Blind Eagle MAR 2025)","relationship_id":"relationship--50189f72-7432-4af7-a600-50a95c8c641f","references":[{"source_name":"Check Point Blind Eagle MAR 2025","description":"Check Point Research. (2025, March 10). Blind Eagle: …And Justice for All. Retrieved April 16, 2026.","url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"}]},{"id":"S9020","name":"LODEINFO","url":"https://attack.mitre.org/software/S9020","kind":"malware","description":"[LODEINFO](https://attack.mitre.org/software/S9020) can identify the associated username on targeted machines.(Citation: ITOCHU LODEINFO JAN 2024)","relationship_id":"relationship--cf5301fc-fc68-42ff-828f-280c8d0ed19f","references":[{"source_name":"ITOCHU LODEINFO JAN 2024","description":"ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"}]},{"id":"S9023","name":"HiddenFace","url":"https://attack.mitre.org/software/S9023","kind":"malware","description":"[HiddenFace](https://attack.mitre.org/software/S9023) can collect the username associated with the compromised host.(Citation: ESET HiddenFace 2024)\n","relationship_id":"relationship--59f27a62-6748-44d0-b9aa-ef976dd97502","references":[{"source_name":"ESET HiddenFace 2024","description":"Breitenbacher, D. (2024). Unmasking HiddenFace. Retrieved April 17, 2026.","url":"https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_2_8_Breitenbacher_en.pdf"}]},{"id":"S9029","name":"IronWind","url":"https://attack.mitre.org/software/S9029","kind":"malware","description":"[IronWind](https://attack.mitre.org/software/S9029) can enumerate the username on victim's systems.(Citation: Check Point Wirte NOV 2024)","relationship_id":"relationship--3cef14da-0d49-4ee4-920b-ce3a0ddeccc7","references":[{"source_name":"Check Point Wirte NOV 2024","description":"Check Point. (2024, November 12). Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity. Retrieved April 20, 2026.","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}]},{"id":"S9035","name":"LAMEHUG","url":"https://attack.mitre.org/software/S9035","kind":"malware","description":"[LAMEHUG](https://attack.mitre.org/software/S9035) can use `whoami` to enumerate the system user.(Citation: Splunk LAMEHUG SEP 2025)","relationship_id":"relationship--24e3810a-7d05-4ccc-9326-80a5ac72cd55","references":[{"source_name":"Splunk LAMEHUG SEP 2025","description":"Conteras, T., Splunk Research Team. (2025, September 25). From Prompt to Payload: LAMEHUG’s LLM-Driven Cyber Intrusion. Retrieved April 21, 2026.","url":"https://www.splunk.com/en_us/blog/security/lamehug-ai-driven-malware-llm-cyber-intrusion-analysis.html"}]},{"id":"S9037","name":"RustyWater","url":"https://attack.mitre.org/software/S9037","kind":"malware","description":"[RustyWater](https://attack.mitre.org/software/S9037) has gathered the victim machine’s username.(Citation: CloudSEK_RustyWater_Jan2026)   ","relationship_id":"relationship--0daaaf08-6db8-4b57-8ba7-ff1cc32127b3","references":[{"source_name":"CloudSEK_RustyWater_Jan2026","description":"Awasthi, P. (2026, January 8). Reborn in Rust: Muddy Water Evolves Tooling with RustyWater Implant. Retrieved March 19, 2026.","url":"https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant"}]},{"id":"S9041","name":"TeamPCP Cloud Stealer","url":"https://attack.mitre.org/software/S9041","kind":"malware","description":"[TeamPCP Cloud Stealer](https://attack.mitre.org/software/S9041) can use `whoami` on self-hosted runners to identify the current user.(Citation: Aqua Security Blog Trivy Compromise APR 2026)","relationship_id":"relationship--d08adc0f-5bf5-40cd-80ab-3c6ce1b46749","references":[{"source_name":"Aqua Security Blog Trivy Compromise APR 2026","description":"Aqua Team. (2026, April 1). Update: Ongoing Investigation and Continued Remediation. Retrieved July 1, 2026.","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"}]},{"id":"S9042","name":"CanisterWorm","url":"https://attack.mitre.org/software/S9042","kind":"malware","description":"[CanisterWorm](https://attack.mitre.org/software/S9042) has parsed the /var/log/auth.log and /var/log/secure files for usernames.(Citation: Aikido CanisterWorm MAR 2026)","relationship_id":"relationship--616cbad8-87d2-4264-ab07-130ad3871299","references":[{"source_name":"Aikido CanisterWorm MAR 2026","description":"Eriksen, C. (2026, March 22). CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran. Retrieved July 27, 2026.","url":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran"}]},{"id":"S9043","name":"Mini Shai-Hulud","url":"https://attack.mitre.org/software/S9043","kind":"malware","description":"[Mini Shai-Hulud](https://attack.mitre.org/software/S9043) has leveraged commands such as `whoami` to identify the system owner.(Citation: Trend Micro TeamPCP MAY 2026)","relationship_id":"relationship--d16e6d0b-b602-49dc-ac14-72b0355b6d5c","references":[{"source_name":"Trend Micro TeamPCP MAY 2026","description":"Santos, J. and Navato, J.R. (2026, May 13). Analyzing TeamPCP’s Supply Chain Attacks: Checkmarx KICS and elementary-data in CI/CD Credential Theft. Retrieved July 16, 2026.","url":"https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"}]},{"id":"S9046","name":"IOControl","url":"https://attack.mitre.org/software/S9046","kind":"malware","description":"IOCONTROL has used the `whoami` command to get the current user on the system.(Citation: Claroty-IOCONTROL)(Citation: Armis-IOCONTROL)","relationship_id":"relationship--415d2462-fe5c-44b1-9ffb-62b51c51b8e0","references":[{"source_name":"Claroty-IOCONTROL","description":"Claroty Team82. (2024, December 10). Inside a New OT/IoT Cyberweapon: IOCONTROL. Retrieved September 2, 2026.","url":"https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol"},{"source_name":"Armis-IOCONTROL","description":"Michael Freeman. (2024, December 16). IOControl Malware: What's New, What's Not?. Retrieved September 2, 2026.","url":"https://www.armis.com/blog/iocontrol-malware-whats-new-whats-not/"}]},{"id":"S9052","name":"MiniFast","url":"https://attack.mitre.org/software/S9052","kind":"malware","description":"[MiniFast](https://attack.mitre.org/software/S9052) has collected the username on targeted systems.(Citation: CheckPoint_NimbusManticore_May2026)","relationship_id":"relationship--7b7233f3-33a0-4d82-8333-7f89e051653e","references":[{"source_name":"CheckPoint_NimbusManticore_May2026","description":"Check Point. (2026, May 22). Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict. Retrieved September 23, 2026.","url":"https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"}]},{"id":"S9053","name":"MiniJunk","url":"https://attack.mitre.org/software/S9053","kind":"malware","description":"[MiniJunk](https://attack.mitre.org/software/S9053) has collected the domain name with username.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025) ","relationship_id":"relationship--0624c9a4-4c9f-448c-99f0-c22a99480158","references":[{"source_name":"CheckPoint_NimbusManticoreEurope_Sept2025","description":"Check Point. (2025, September 22). Nimbus Manticore Deploys New Malware Targeting Europe. Retrieved September 24, 2026.","url":"https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"}]},{"id":"S9062","name":"MiniBrowse","url":"https://attack.mitre.org/software/S9062","kind":"malware","description":"[MiniBrowse](https://attack.mitre.org/software/S9062) has the ability to gather the username associated with the victim host.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)","relationship_id":"relationship--20b43c4b-c97d-4f5f-a004-07f38a9851e1","references":[{"source_name":"CheckPoint_NimbusManticoreEurope_Sept2025","description":"Check Point. (2025, September 22). Nimbus Manticore Deploys New Malware Targeting Europe. Retrieved September 24, 2026.","url":"https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"}]},{"id":"S9063","name":"DEEPROOT","url":"https://attack.mitre.org/software/S9063","kind":"malware","description":"[DEEPROOT](https://attack.mitre.org/software/S9063) can obtain the victim’s username.(Citation: Mandiant_UNC1549_Nov2025)","relationship_id":"relationship--0e6418d5-a827-4a88-adb2-af4f26b4502b","references":[{"source_name":"Mandiant_UNC1549_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]},{"id":"S9067","name":"TWOSTROKE","url":"https://attack.mitre.org/software/S9067","kind":"malware","description":"[TWOSTROKE](https://attack.mitre.org/software/S9067) has gathered the full victim name.(Citation: Mandiant_UNC1549_Nov2025)","relationship_id":"relationship--baaa0717-b809-476b-93ee-60c87d900193","references":[{"source_name":"Mandiant_UNC1549_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]}],"actors":[{"id":"G0004","name":"Ke3chang","url":"https://attack.mitre.org/groups/G0004","kind":"intrusion-set","description":"[Ke3chang](https://attack.mitre.org/groups/G0004) has used implants capable of collecting the signed-in username.(Citation: Microsoft NICKEL December 2021)","relationship_id":"relationship--199c92d9-dd54-4cb1-beef-3b6a97d12e82","references":[{"source_name":"Microsoft NICKEL December 2021","description":"MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022.","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"id":"G0022","name":"APT3","url":"https://attack.mitre.org/groups/G0022","kind":"intrusion-set","description":"An [APT3](https://attack.mitre.org/groups/G0022) downloader uses the Windows command <code>\"cmd.exe\" /C whoami</code> to verify that it is running with the elevated privileges of “System.”(Citation: FireEye Operation Double Tap)","relationship_id":"relationship--fcfb3ce0-01a0-4f92-8e18-b323202d095d","references":[{"source_name":"FireEye Operation Double Tap","description":"Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.","url":"https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html"}]},{"id":"G0027","name":"Threat Group-3390","url":"https://attack.mitre.org/groups/G0027","kind":"intrusion-set","description":"[Threat Group-3390](https://attack.mitre.org/groups/G0027) has used `whoami` to collect system user information.(Citation: Trend Micro DRBControl February 2020)","relationship_id":"relationship--590756ce-b948-4d62-9608-4fadf58681f4","references":[{"source_name":"Trend Micro DRBControl February 2020","description":"Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}]},{"id":"G0032","name":"Lazarus Group","url":"https://attack.mitre.org/groups/G0032","kind":"intrusion-set","description":"Various [Lazarus Group](https://attack.mitre.org/groups/G0032) malware enumerates logged-on users.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)(Citation: Novetta Blockbuster Loaders)(Citation: Novetta Blockbuster RATs)(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: SentinelOne Lazarus macOS July 2020)(Citation: Lazarus APT January 2022)","relationship_id":"relationship--500130c0-d049-4e67-9bcc-d60a5f6dfd4c","references":[{"source_name":"Novetta Blockbuster Destructive Malware","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Destructive Malware Report. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source_name":"Novetta Blockbuster Loaders","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Loaders, Installers and Uninstallers Report. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster RATs","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Remote Administration Tools & Content Staging Malware Report. Retrieved March 16, 2016.","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source_name":"Novetta Blockbuster","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"Lazarus APT January 2022","description":"Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","description":"Sherstobitoff, R. (2018, February 12). Lazarus Resurfaces, Targets Global Banks and Bitcoin Users. Retrieved February 19, 2018.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source_name":"SentinelOne Lazarus macOS July 2020","description":"Stokes, P. (2020, July 27). Four Distinct Families of Lazarus Malware Target Apple’s macOS Platform. Retrieved August 7, 2020.","url":"https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/"}]},{"id":"G0034","name":"Sandworm Team","url":"https://attack.mitre.org/groups/G0034","kind":"intrusion-set","description":"[Sandworm Team](https://attack.mitre.org/groups/G0034) has collected the username from a compromised host.(Citation: US District Court Indictment GRU Unit 74455 October 2020)","relationship_id":"relationship--ef041776-abd8-4e6f-8737-07e724e68cd1","references":[{"source_name":"US District Court Indictment GRU Unit 74455 October 2020","description":"Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"id":"G0035","name":"Dragonfly","url":"https://attack.mitre.org/groups/G0035","kind":"intrusion-set","description":"[Dragonfly](https://attack.mitre.org/groups/G0035) used the command <code>query user</code> on victim hosts.(Citation: US-CERT TA18-074A)","relationship_id":"relationship--e13ba463-59c5-4e50-9aeb-420ab5e677db","references":[{"source_name":"US-CERT TA18-074A","description":"US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"id":"G0038","name":"Stealth Falcon","url":"https://attack.mitre.org/groups/G0038","kind":"intrusion-set","description":"[Stealth Falcon](https://attack.mitre.org/groups/G0038) malware gathers the registered user and primary owner name via WMI.(Citation: Citizen Lab Stealth Falcon May 2016)","relationship_id":"relationship--8ebab956-4440-4fd7-96ff-8da29e0f0b46","references":[{"source_name":"Citizen Lab Stealth Falcon May 2016","description":"Marczak, B. and Scott-Railton, J.. (2016, May 29). Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents. Retrieved June 8, 2016.","url":"https://citizenlab.org/2016/05/stealth-falcon/"}]},{"id":"G0040","name":"Patchwork","url":"https://attack.mitre.org/groups/G0040","kind":"intrusion-set","description":"[Patchwork](https://attack.mitre.org/groups/G0040) collected the victim username and whether it was running as admin, then sent the information to its C2 server.(Citation: Cymmetria Patchwork)(Citation: TrendMicro Patchwork Dec 2017)","relationship_id":"relationship--8bb44b86-379d-49ba-9b28-2451e69db30d","references":[{"source_name":"Cymmetria Patchwork","description":"Cymmetria. (2016). Unveiling Patchwork - The Copy-Paste APT. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"},{"source_name":"TrendMicro Patchwork Dec 2017","description":"Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"id":"G0046","name":"FIN7","url":"https://attack.mitre.org/groups/G0046","kind":"intrusion-set","description":"[FIN7](https://attack.mitre.org/groups/G0046) has used the command `cmd.exe /C quser` to collect user session information.(Citation: Mandiant FIN7 Apr 2022)","relationship_id":"relationship--1f548074-df9e-4029-842b-7d774e2f1093","references":[{"source_name":"Mandiant FIN7 Apr 2022","description":"Abdo, B., et al. (2022, April 4). FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7. Retrieved April 5, 2022.","url":"https://www.mandiant.com/resources/evolution-of-fin7"}]},{"id":"G0047","name":"Gamaredon Group","url":"https://attack.mitre.org/groups/G0047","kind":"intrusion-set","description":"A [Gamaredon Group](https://attack.mitre.org/groups/G0047) file stealer can gather the victim's username to send to a C2 server.(Citation: Palo Alto Gamaredon Feb 2017)","relationship_id":"relationship--a5ffea60-7694-48cd-92e9-b755669b2fdb","references":[{"source_name":"Palo Alto Gamaredon Feb 2017","description":"Kasza, A. and Reichel, D. (2017, February 27). The Gamaredon Group Toolset Evolution. Retrieved March 1, 2017.","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"}]},{"id":"G0049","name":"OilRig","url":"https://attack.mitre.org/groups/G0049","kind":"intrusion-set","description":"[OilRig](https://attack.mitre.org/groups/G0049) has run <code>whoami</code> on a victim.(Citation: Palo Alto OilRig May 2016)(Citation: Palo Alto OilRig Oct 2016)(Citation: Check Point APT34 April 2021)","relationship_id":"relationship--b22cebe6-129a-41a2-8a9e-70c222c88af6","references":[{"source_name":"Palo Alto OilRig May 2016","description":"Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.","url":"http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"},{"source_name":"Palo Alto OilRig Oct 2016","description":"Grunzweig, J. and Falcone, R.. (2016, October 4). OilRig Malware Campaign Updates Toolset and Expands Targets. Retrieved May 3, 2017.","url":"http://researchcenter.paloaltonetworks.com/2016/10/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/"},{"source_name":"Check Point APT34 April 2021","description":"Check Point. (2021, April 8). Iran’s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021.","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"}]},{"id":"G0050","name":"APT32","url":"https://attack.mitre.org/groups/G0050","kind":"intrusion-set","description":"[APT32](https://attack.mitre.org/groups/G0050) collected the victim's username and executed the <code>whoami</code> command on the victim's machine. [APT32](https://attack.mitre.org/groups/G0050) executed shellcode to collect the username on the victim's machine. (Citation: FireEye APT32 April 2020)(Citation: ESET OceanLotus)(Citation: Cybereason Cobalt Kitty 2017)","relationship_id":"relationship--40032198-f003-4171-92a0-faf038f62a0b","references":[{"source_name":"FireEye APT32 April 2020","description":"Henderson, S., et al. (2020, April 22). Vietnamese Threat Actors APT32 Targeting Wuhan Government and Chinese Ministry of Emergency Management in Latest Example of COVID-19 Related Espionage. Retrieved April 28, 2020.","url":"https://www.fireeye.com/blog/threat-research/2020/04/apt32-targeting-chinese-government-in-covid-19-related-espionage.html"},{"source_name":"ESET OceanLotus","description":"Foltýn, T. (2018, March 13). OceanLotus ships new backdoor using old tricks. Retrieved May 22, 2018.","url":"https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/"},{"source_name":"Cybereason Cobalt Kitty 2017","description":"Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"id":"G0051","name":"FIN10","url":"https://attack.mitre.org/groups/G0051","kind":"intrusion-set","description":"[FIN10](https://attack.mitre.org/groups/G0051) has used Meterpreter to enumerate users on remote systems.(Citation: FireEye FIN10 June 2017)","relationship_id":"relationship--3d602fec-cf94-4aa4-a4d9-cad286e6881f","references":[{"source_name":"FireEye FIN10 June 2017","description":"FireEye iSIGHT Intelligence. (2017, June 16). FIN10: Anatomy of a Cyber Extortion Operation. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/rpt-fin-10-anatomy-of-a-cyber-en.pdf"}]},{"id":"G0059","name":"Magic Hound","url":"https://attack.mitre.org/groups/G0059","kind":"intrusion-set","description":"[Magic Hound](https://attack.mitre.org/groups/G0059) malware has obtained the victim username and sent it to the C2 server.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)","relationship_id":"relationship--7ac10827-9bf6-4d60-aa16-9f2d2930b373","references":[{"source_name":"DFIR Phosphorus November 2021","description":"DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023.","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source_name":"DFIR Report APT35 ProxyShell March 2022","description":"DFIR Report. (2022, March 21). APT35 Automates Initial Access Using ProxyShell. Retrieved May 25, 2022.","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"},{"source_name":"Unit 42 Magic Hound Feb 2017","description":"Lee, B. and Falcone, R. (2017, February 15). Magic Hound Campaign Attacks Saudi Targets. Retrieved December 27, 2017.","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}]},{"id":"G0061","name":"FIN8","url":"https://attack.mitre.org/groups/G0061","kind":"intrusion-set","description":"[FIN8](https://attack.mitre.org/groups/G0061) has executed the command `quser` to display the session details of a compromised machine.(Citation: Symantec FIN8 Jul 2023) ","relationship_id":"relationship--17bace22-3930-4b7e-9fd1-1473da5496ff","references":[{"source_name":"Symantec FIN8 Jul 2023","description":"Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor"}]},{"id":"G0067","name":"APT37","url":"https://attack.mitre.org/groups/G0067","kind":"intrusion-set","description":"[APT37](https://attack.mitre.org/groups/G0067) identifies the victim username.(Citation: Talos Group123)","relationship_id":"relationship--4b253464-5a8b-4129-ab1b-ab888314f900","references":[{"source_name":"Talos Group123","description":"Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"}]},{"id":"G0069","name":"MuddyWater","url":"https://attack.mitre.org/groups/G0069","kind":"intrusion-set","description":"[MuddyWater](https://attack.mitre.org/groups/G0069) has used malware that can collect the victim’s username.(Citation: Securelist MuddyWater Oct 2018)(Citation: Trend Micro Muddy Water March 2021)","relationship_id":"relationship--d1d496f1-fa91-404e-a93a-97670817717a","references":[{"source_name":"Securelist MuddyWater Oct 2018","description":"Kaspersky Lab's Global Research & Analysis Team. (2018, October 10). MuddyWater expands operations. Retrieved November 2, 2018.","url":"https://securelist.com/muddywater/88059/"},{"source_name":"Trend Micro Muddy Water March 2021","description":"Peretz, A. and Theck, E. (2021, March 5). Earth Vetala – MuddyWater Continues to Target Organizations in the Middle East. Retrieved March 18, 2021.","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}]},{"id":"G0073","name":"APT19","url":"https://attack.mitre.org/groups/G0073","kind":"intrusion-set","description":"[APT19](https://attack.mitre.org/groups/G0073) used an HTTP malware variant and a Port 22 malware variant to collect the victim’s username.(Citation: Unit 42 C0d0so0 Jan 2016)","relationship_id":"relationship--331ebf73-af72-4121-815a-d10392ac75ab","references":[{"source_name":"Unit 42 C0d0so0 Jan 2016","description":"Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.","url":"https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/"}]},{"id":"G0081","name":"Tropic Trooper","url":"https://attack.mitre.org/groups/G0081","kind":"intrusion-set","description":"[Tropic Trooper](https://attack.mitre.org/groups/G0081) used <code>letmein</code> to scan for saved usernames on the target system.(Citation: TrendMicro TropicTrooper 2015)","relationship_id":"relationship--58a7f0d9-7c20-4808-b8be-bd6240267030","references":[{"source_name":"TrendMicro TropicTrooper 2015","description":"Alintanahin, K. (2015). Operation Tropic Trooper: Relying on Tried-and-Tested Flaws to Infiltrate Secret Keepers. Retrieved June 14, 2019.","url":"https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf"}]},{"id":"G0082","name":"APT38","url":"https://attack.mitre.org/groups/G0082","kind":"intrusion-set","description":"[APT38](https://attack.mitre.org/groups/G0082) has identified primary users, currently logged in users, sets of users that commonly use a system, or inactive users.(Citation: CISA AA20-239A BeagleBoyz August 2020) [APT38](https://attack.mitre.org/groups/G0082) has run malware to enumerate the current user on compromised hosts.(Citation: Microsoft Sapphire Sleet APR 2026)(Citation: MIcrosoft Mastra npm Compromise JUN 2026)","relationship_id":"relationship--064cfeb5-9ddb-4dd2-ada4-cf9e65601dc5","references":[{"source_name":"CISA AA20-239A BeagleBoyz August 2020","description":"DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"},{"source_name":"Microsoft Sapphire Sleet APR 2026","description":"Microsoft Threat Intelligence. (2026, April 16). Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise. Retrieved September 30, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/"},{"source_name":"MIcrosoft Mastra npm Compromise JUN 2026","description":"Microsoft Threat Intelligence. (2026, June 17). From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet. Retrieved September 30, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"}]},{"id":"G0087","name":"APT39","url":"https://attack.mitre.org/groups/G0087","kind":"intrusion-set","description":"[APT39](https://attack.mitre.org/groups/G0087) used [Remexi](https://attack.mitre.org/software/S0375) to collect usernames from the system.(Citation: Symantec Chafer Dec 2015)","relationship_id":"relationship--439344c5-67e0-4d38-9b91-866392e5e232","references":[{"source_name":"Symantec Chafer Dec 2015","description":"Symantec Security Response. (2015, December 7). Iran-based attackers use back door threats to spy on Middle Eastern targets. Retrieved April 17, 2019.","url":"https://www.symantec.com/connect/blogs/iran-based-attackers-use-back-door-threats-spy-middle-eastern-targets"}]},{"id":"G0093","name":"GALLIUM","url":"https://attack.mitre.org/groups/G0093","kind":"intrusion-set","description":"[GALLIUM](https://attack.mitre.org/groups/G0093) used <code>whoami</code> and <code>query user</code> to obtain information about the victim user.(Citation: Cybereason Soft Cell June 2019)","relationship_id":"relationship--aa64ee12-ae96-40fe-ba37-a8893cd321ec","references":[{"source_name":"Cybereason Soft Cell June 2019","description":"Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019.","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has gathered the identity of the user by querying `System.Security.Principal` namespace using the `GetCurrent()` method.(Citation: Aryaka Kimsuky July 2025)","relationship_id":"relationship--db67d1d5-5412-486f-9f86-446dd5b2521d","references":[{"source_name":"Aryaka Kimsuky July 2025","description":"Varadharajan Krishnasamy, Aditya K Sood. (2025, July 29). From Reconnaissance  to Control: The Operational Blueprint of Kimsuky APT  for Cyber Espionage. Retrieved April 18, 2026.","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"id":"G0096","name":"APT41","url":"https://attack.mitre.org/groups/G0096","kind":"intrusion-set","description":"[APT41](https://attack.mitre.org/groups/G0096) has executed <code>whoami</code> commands, including using the WMIEXEC utility to execute this on remote machines.(Citation: FireEye APT41 Aug 2019)(Citation: Rostovcev APT41 2021)","relationship_id":"relationship--ae12b657-a640-40c6-99b7-931ed10705de","references":[{"source_name":"FireEye APT41 Aug 2019","description":"Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"},{"source_name":"Rostovcev APT41 2021","description":"Nikita Rostovcev. (2022, August 18). APT41 World Tour 2021 on a tight schedule. Retrieved February 22, 2024.","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"id":"G0102","name":"Wizard Spider","url":"https://attack.mitre.org/groups/G0102","kind":"intrusion-set","description":"[Wizard Spider](https://attack.mitre.org/groups/G0102) has used \"whoami\" to identify the local user and their privileges.(Citation: Sophos New Ryuk Attack October 2020)","relationship_id":"relationship--aca710ff-23a3-4c78-b75a-dfe6cad337a9","references":[{"source_name":"Sophos New Ryuk Attack October 2020","description":"Sean Gallagher, Peter Mackenzie, Elida Leite, Syed Shahram, Bill Kearney, Anand Aijan, Sivagnanam Gn, Suraj Mundalik. (2020, October 14). They’re back: inside a new Ryuk ransomware attack. Retrieved October 14, 2020.","url":"https://news.sophos.com/en-us/2020/10/14/inside-a-new-ryuk-ransomware-attack/"}]},{"id":"G0112","name":"Windshift","url":"https://attack.mitre.org/groups/G0112","kind":"intrusion-set","description":"[Windshift](https://attack.mitre.org/groups/G0112) has used malware to identify the username on a compromised host.(Citation: BlackBerry Bahamut)","relationship_id":"relationship--caf951a5-6952-4966-941d-71d9cd598b28","references":[{"source_name":"BlackBerry Bahamut","description":"The BlackBerry Research & Intelligence Team. (2020, October). BAHAMUT: Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps. Retrieved February 8, 2021.","url":"https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"}]},{"id":"G0114","name":"Chimera","url":"https://attack.mitre.org/groups/G0114","kind":"intrusion-set","description":"[Chimera](https://attack.mitre.org/groups/G0114) has used the <code>quser</code> command to show currently logged on users.(Citation: NCC Group Chimera January 2021) ","relationship_id":"relationship--85278437-ae97-477e-b7cf-d2bad3fd1c6e","references":[{"source_name":"NCC Group Chimera January 2021","description":"Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"id":"G0121","name":"Sidewinder","url":"https://attack.mitre.org/groups/G0121","kind":"intrusion-set","description":"[Sidewinder](https://attack.mitre.org/groups/G0121) has used tools to identify the user of a compromised host.(Citation: ATT Sidewinder January 2021)","relationship_id":"relationship--fc43ba07-ffa2-4617-95ac-7ff6462eccd0","references":[{"source_name":"ATT Sidewinder January 2021","description":"Hegel, T. (2021, January 13). A Global Perspective of the SideWinder APT. Retrieved January 27, 2021.","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"}]},{"id":"G0125","name":"HAFNIUM","url":"https://attack.mitre.org/groups/G0125","kind":"intrusion-set","description":"[HAFNIUM](https://attack.mitre.org/groups/G0125) has used `whoami` to gather user information.(Citation: Rapid7 HAFNIUM Mar 2021)","relationship_id":"relationship--1ffb7c73-5c51-48a3-85a0-b64111cccdd1","references":[{"source_name":"Rapid7 HAFNIUM Mar 2021","description":"Eoin Miller. (2021, March 23). Defending Against the Zero Day: Analyzing Attacker Behavior Post-Exploitation of Microsoft Exchange. Retrieved October 27, 2022.","url":"https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"}]},{"id":"G0128","name":"ZIRCONIUM","url":"https://attack.mitre.org/groups/G0128","kind":"intrusion-set","description":"[ZIRCONIUM](https://attack.mitre.org/groups/G0128) has used a tool to capture the username on a compromised host in order to register it with C2.(Citation: Zscaler APT31 Covid-19 October 2020)","relationship_id":"relationship--7b143b11-1fe5-4dc1-9790-3cd05659adc4","references":[{"source_name":"Zscaler APT31 Covid-19 October 2020","description":"Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"id":"G0143","name":"Aquatic Panda","url":"https://attack.mitre.org/groups/G0143","kind":"intrusion-set","description":"[Aquatic Panda](https://attack.mitre.org/groups/G0143) gathers information on recently logged-in users on victim devices.(Citation: Crowdstrike HuntReport 2022)","relationship_id":"relationship--98a50c7b-353d-4bbd-bd66-799d79b389a0","references":[{"source_name":"Crowdstrike HuntReport 2022","description":"CrowdStrike. (2023). 2022 Falcon OverWatch Threat Hunting Report. Retrieved May 20, 2024.","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}]},{"id":"G1001","name":"HEXANE","url":"https://attack.mitre.org/groups/G1001","kind":"intrusion-set","description":"[HEXANE](https://attack.mitre.org/groups/G1001) has run `whoami` on compromised machines to identify the current user.(Citation: Kaspersky Lyceum October 2021)","relationship_id":"relationship--ba2c0c39-5b92-45d1-827f-5f2b454d3981","references":[{"source_name":"Kaspersky Lyceum October 2021","description":"Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"id":"G1006","name":"Earth Lusca","url":"https://attack.mitre.org/groups/G1006","kind":"intrusion-set","description":"[Earth Lusca](https://attack.mitre.org/groups/G1006) collected information on user accounts via the <code>whoami</code> command.(Citation: TrendMicro EarthLusca 2022)","relationship_id":"relationship--5fc9189b-7c9b-43f7-8d60-96a1f497e395","references":[{"source_name":"TrendMicro EarthLusca 2022","description":"Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"id":"G1014","name":"LuminousMoth","url":"https://attack.mitre.org/groups/G1014","kind":"intrusion-set","description":"[LuminousMoth](https://attack.mitre.org/groups/G1014) has used a malicious DLL to collect the username from compromised hosts.(Citation: Bitdefender LuminousMoth July 2021)","relationship_id":"relationship--986f3f81-7872-4c99-a704-4e53f2936e26","references":[{"source_name":"Bitdefender LuminousMoth July 2021","description":"Botezatu, B and etl. (2021, July 21). LuminousMoth - PlugX, File Exfiltration and Persistence Revisited. Retrieved October 20, 2022.","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"}]},{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"\n[Volt Typhoon](https://attack.mitre.org/groups/G1017) has used public tools and executed the PowerShell command `Get-EventLog security -instanceid 4624` to identify associated user and computer account names.(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)(Citation: Secureworks BRONZE SILHOUETTE May 2023)(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)","relationship_id":"relationship--93965fb7-e50d-45c8-a0db-354ce8ee05b8","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","description":"CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source_name":"Secureworks BRONZE SILHOUETTE May 2023","description":"Counter Threat Unit Research Team. (2023, May 24). Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S. Government and Defense Organizations. Retrieved July 27, 2023.","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"},{"source_name":"Joint Cybersecurity Advisory Volt Typhoon June 2023","description":"NSA et al. (2023, May 24). People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection. Retrieved July 27, 2023.","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}]},{"id":"G1035","name":"Winter Vivern","url":"https://attack.mitre.org/groups/G1035","kind":"intrusion-set","description":"[Winter Vivern](https://attack.mitre.org/groups/G1035) PowerShell scripts execute `whoami` to identify the executing user.(Citation: SentinelOne WinterVivern 2023)","relationship_id":"relationship--284843c3-18d0-4ddb-aab5-4588a6ec400e","references":[{"source_name":"SentinelOne WinterVivern 2023","description":"Tom Hegel. (2023, March 16). Winter Vivern | Uncovering a Wave of Global Espionage. Retrieved July 29, 2024.","url":"https://www.sentinelone.com/labs/winter-vivern-uncovering-a-wave-of-global-espionage/"}]},{"id":"G1036","name":"Moonstone Sleet","url":"https://attack.mitre.org/groups/G1036","kind":"intrusion-set","description":"[Moonstone Sleet](https://attack.mitre.org/groups/G1036) deployed various malware such as YouieLoader that can perform system user discovery actions.(Citation: Microsoft Moonstone Sleet 2024)","relationship_id":"relationship--0b5338ac-c1ca-4296-b06c-44d3730c8557","references":[{"source_name":"Microsoft Moonstone Sleet 2024","description":"Microsoft Threat Intelligence. (2024, May 28). Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks. Retrieved August 26, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"id":"G1046","name":"Storm-1811","url":"https://attack.mitre.org/groups/G1046","kind":"intrusion-set","description":"[Storm-1811](https://attack.mitre.org/groups/G1046) has used `whoami.exe` to determine if the active user on a compromised system is an administrator.(Citation: rapid7-email-bombing)","relationship_id":"relationship--ef8e36e1-24ce-4d32-9c78-40388e1f07b9","references":[{"source_name":"rapid7-email-bombing","description":"Tyler McGraw, Thomas Elkins, and Evan McCann. (2024, May 10). Ongoing Social Engineering Campaign Linked to Black Basta Ransomware Operators. Retrieved January 31, 2025.","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]},{"id":"G1051","name":"Medusa Group","url":"https://attack.mitre.org/groups/G1051","kind":"intrusion-set","description":"[Medusa Group](https://attack.mitre.org/groups/G1051) has utilized [PsExec](https://attack.mitre.org/software/S0029) to execute `quser` to discover the user session information.(Citation: Broadcom Medusa Ransomware Medusa Group March 2025)","relationship_id":"relationship--eea81537-0c40-4b50-963d-d4f61ccf0554","references":[{"source_name":"Broadcom Medusa Ransomware Medusa Group March 2025","description":"Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"}]},{"id":"G1054","name":"MirrorFace","url":"https://attack.mitre.org/groups/G1054","kind":"intrusion-set","description":"[MirrorFace](https://attack.mitre.org/groups/G1054) has used Windows native tools to enumerate user information.(Citation: Trend Micro Earth Kasha NOV 2024)","relationship_id":"relationship--ee3c7d3c-f7c9-4165-af4b-ebc45a7aae3f","references":[{"source_name":"Trend Micro Earth Kasha NOV 2024","description":"Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]}],"mitigations":[],"candidates":[{"id":"1392bd0f-5d5a-429e-81d9-eb9d4d4d5b3b","name":"GetCurrent User with PowerShell Script","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml","description":"Use the PowerShell \"GetCurrent\" method of the WindowsIdentity .NET class to identify the logged user.","inputs":{},"dependencies":[],"source_definition_sha256":"5e249cef69315d6ceb6cf3ee3b3cc19dace81a93a86d85edeb934b7415ea4cfd"},{"id":"29857f27-a36f-4f7e-8084-4557cd6207ca","name":"Find computers where user has session - Stealth mode (PowerView)","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml","description":"Find existing user session on other computers. Upon execution, information about any sessions discovered will be displayed.","inputs":{},"dependencies":[],"source_definition_sha256":"553b4d39baa2df7bd4bfe0ef537587feacaa2d2ffe3e8aa5a92ee09ab6b214eb"},{"id":"2a9b677d-a230-44f4-ad86-782df1ef108c","name":"System Owner/User Discovery","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml","description":"Identify System owner or users on an endpoint\n\nUpon successful execution, sh will stdout list of usernames.\n","inputs":{},"dependencies":[],"source_definition_sha256":"d04c3a0513103ae97ceb4e824d9dbfcf37a0ed9d797bb4f227b9f7c0b6d9b614"},{"id":"3d257a03-eb80-41c5-b744-bb37ac7f65c7","name":"System Discovery - SocGholish whoami","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml","description":"SocGholish performs whoami discovery commands and outputs the results to a tmp file. \nThe test will generate a filename similar to the random one generated during execution and write the file to AppData\\Temp.\n\nReference: https://redcanary.com/threat-detection-report/threats/socgholish/\n","inputs":{"output_path":{"description":"Location of output file","type":"string","default":"$env:temp"}},"dependencies":[],"source_definition_sha256":"d4de351c711fc0c934b4907f7e6ced97f4b5d9f031918f6e1a1e287e97a0df24"},{"id":"4c4959bf-addf-4b4a-be86-8d09cc1857aa","name":"System Owner/User Discovery","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml","description":"Identify System owner or users on an endpoint.\n\nUpon successful execution, cmd.exe will spawn multiple commands against a target host to identify usernames. Output will be via stdout. \nAdditionally, two files will be written to disk - computers.txt and usernames.txt.\n","inputs":{"computer_name":{"description":"Name of remote computer","type":"string","default":"localhost"}},"dependencies":[],"source_definition_sha256":"1ce5d5be6eefd59ed364b7bca36ccfc994d2ef1af68a52646c3687645398f773"},{"id":"aab580c7-cc30-4a7c-b5a9-46a29066b022","name":"User Discovery - whoami","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml","description":"Identify the current user account and security context using whoami. Adversaries use this command during initial\nreconnaissance after gaining access to a system to determine the user and privilege level they are operating under.\n","inputs":{"whoami_args":{"description":"Arguments to pass to whoami (e.g. /all, /priv, /groups, /user)","type":"string","default":"/all"}},"dependencies":[],"source_definition_sha256":"45a110a3074230b3828fe42b3214877ae13508e638a26b7271da0c441c9f0614"},{"id":"ba38e193-37a6-4c41-b214-61b33277fe36","name":"System Owner/User Discovery Using Command Prompt","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml","description":"Identify the system owner or current user using native Windows command prompt utilities.","inputs":{"output_file_path":{"description":"Location of output file.","type":"string","default":"$env:temp"}},"dependencies":[],"source_definition_sha256":"4ac633d373e7d190db8114d98cd2de625d10890e0b9e216b98295d2e32da9bf3"},{"id":"dcb6cdee-1fb0-4087-8bf8-88cfd136ba51","name":"User Discovery With Env Vars PowerShell Script","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml","description":"Use the PowerShell environment variables to identify the current logged user.","inputs":{},"dependencies":[],"source_definition_sha256":"db5385efdb65d207653796953e4a0c883a3978eece0c3d658fe61fec21aae30f"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1003":"/ttp-simulation/techniques/enterprise/T1003/","T1033":"/ttp-simulation/techniques/enterprise/T1033/","T1059.008":"/ttp-simulation/techniques/enterprise/T1059.008/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1033","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}