T1033 System Owner/User Discovery — Detection Rules

Source-backed rule directory

• Possible DCSync Attack · test · high · {"product":"rpc_firewall","category":"application","definition":"Requirements: install and apply the RPC Firewall to all processes, enable DRSR UUID (e3514235-4b06-11d1-ab04-00c04fc2dcd2) for \"dangerous\" opcodes (not 0,1 or 12) only from trusted IPs (DCs)"}
• SharpHound Recon Sessions · test · high · {"product":"rpc_firewall","category":"application","definition":"Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:4b324fc8-1670-01d3-1278-5a47bf6ee188 opnum:12"}
• System Owner or User Discovery - Linux · test · low · {"product":"linux","service":"auditd"}
• ESXi Network Configuration Discovery Via ESXCLI · test · medium · {"category":"process_creation","product":"linux"}
• ESXi Storage Information Discovery Via ESXCLI · test · medium · {"category":"process_creation","product":"linux"}
• ESXi System Information Discovery Via ESXCLI · test · medium · {"category":"process_creation","product":"linux"}
• ESXi VM List Discovery Via ESXCLI · test · medium · {"category":"process_creation","product":"linux"}
• ESXi VSAN Information Discovery Via ESXCLI · test · medium · {"category":"process_creation","product":"linux"}
• Cisco Discovery · test · low · {"product":"cisco","service":"aaa"}
• Get-ADUser Enumeration Using UserAccountControl Flags · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• Suspicious PowerShell Get Current User · test · low · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• User Discovery And Export Via Get-ADUser Cmdlet - PowerShell · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• HackTool - SharpLdapWhoami Execution · test · high · {"category":"process_creation","product":"windows"}
• HackTool - SharpView Execution · test · high · {"category":"process_creation","product":"windows"}
• Computer Discovery And Export Via Get-ADComputer Cmdlet · test · medium · {"category":"process_creation","product":"windows"}
• User Discovery And Export Via Get-ADUser Cmdlet · test · medium · {"category":"process_creation","product":"windows"}
• Renamed Whoami Execution · test · critical · {"category":"process_creation","product":"windows"}
• Local Accounts Discovery · test · low · {"category":"process_creation","product":"windows"}
• WhoAmI as Parameter · test · high · {"category":"process_creation","product":"windows"}
• Chopper Webshell Process Pattern · test · high · {"category":"process_creation","product":"windows"}
• Webshell Hacking Activity Patterns · test · high · {"category":"process_creation","product":"windows"}
• Webshell Detection With Command Line Keywords · test · high · {"category":"process_creation","product":"windows"}
• Enumerate All Information With Whoami.EXE · test · medium · {"category":"process_creation","product":"windows"}
• Whoami.EXE Execution From Privileged Process · test · high · {"category":"process_creation","product":"windows"}
• Group Membership Reconnaissance Via Whoami.EXE · test · medium · {"category":"process_creation","product":"windows"}
• Whoami.EXE Execution With Output Option · test · medium · {"category":"process_creation","product":"windows"}
• Whoami.EXE Execution Anomaly · test · medium · {"category":"process_creation","product":"windows"}
• Security Privileges Enumeration Via Whoami.EXE · test · high · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0093 Behavioral Detection of User Discovery via Local and Remote Enumeration

AN0254 Analytic 0254

Adversary launches built-in system tools (e.g., whoami, query user, net user) or scripts that enumerate user account information via local execution or remote API queries (e.g., WMI, PowerShell).

AN0255 Analytic 0255

Adversary runs commands like `whoami`, `id`, `w`, or `cat /etc/passwd` from non-interactive or scripting contexts to enumerate system user details.

AN0256 Analytic 0256

Adversary uses `dscl`, `who`, or environment variables like `$USER` to identify accounts or sessions via Terminal or malicious LaunchAgents.

AN0257 Analytic 0257

Adversary executes CLI commands like `show users`, `show ssh`, or attempts to dump AAA user lists from routers or switches.