Description
Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping. The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Various utilities and commands may acquire this information, including whoami. In macOS and Linux, the currently logged in user can be identified with w and who. On macOS the dscl . list /Users | grep -v '_' command can also be used to enumerate user accounts. Environment variables, such as %USERNAME% and $USER, may also be used to access this information.
On network devices, Network Device CLI commands such as show users and show ssh can be used to display users currently logged into the device.(Citation: show_ssh_users_cmd_cisco)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)
Platforms
Threat Groups (40)
| ID | Group | Context |
|---|---|---|
| G0082 | APT38 | [APT38](https://attack.mitre.org/groups/G0082) has identified primary users, currently logged in users, sets of users that commonly use a system, or i... |
| G0093 | GALLIUM | [GALLIUM](https://attack.mitre.org/groups/G0093) used <code>whoami</code> and <code>query user</code> to obtain information about the victim user.(Cit... |
| G0022 | APT3 | An [APT3](https://attack.mitre.org/groups/G0022) downloader uses the Windows command <code>"cmd.exe" /C whoami</code> to verify that it is running wit... |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has gathered the identity of the user by querying `System.Security.Principal` namespace using the `Ge... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has used public tools and executed the PowerShell command `Get-EventLog security -instanceid 46... |
| G0040 | Patchwork | [Patchwork](https://attack.mitre.org/groups/G0040) collected the victim username and whether it was running as admin, then sent the information to its... |
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) has executed <code>whoami</code> commands, including using the WMIEXEC utility to execute this on remot... |
| G0035 | Dragonfly | [Dragonfly](https://attack.mitre.org/groups/G0035) used the command <code>query user</code> on victim hosts.(Citation: US-CERT TA18-074A) |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050) collected the victim's username and executed the <code>whoami</code> command on the victim's machine. [... |
| G0125 | HAFNIUM | [HAFNIUM](https://attack.mitre.org/groups/G0125) has used `whoami` to gather user information.(Citation: Rapid7 HAFNIUM Mar 2021) |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has used malware that can collect the victim’s username.(Citation: Securelist MuddyWater Oct 2018)... |
| G0047 | Gamaredon Group | A [Gamaredon Group](https://attack.mitre.org/groups/G0047) file stealer can gather the victim's username to send to a C2 server.(Citation: Palo Alto G... |
| G1046 | Storm-1811 | [Storm-1811](https://attack.mitre.org/groups/G1046) has used `whoami.exe` to determine if the active user on a compromised system is an administrator.... |
| G0046 | FIN7 | [FIN7](https://attack.mitre.org/groups/G0046) has used the command `cmd.exe /C quser` to collect user session information.(Citation: Mandiant FIN7 Apr... |
| G0034 | Sandworm Team | [Sandworm Team](https://attack.mitre.org/groups/G0034) has collected the username from a compromised host.(Citation: US District Court Indictment GRU ... |
| G0121 | Sidewinder | [Sidewinder](https://attack.mitre.org/groups/G0121) has used tools to identify the user of a compromised host.(Citation: ATT Sidewinder January 2021) |
| G0128 | ZIRCONIUM | [ZIRCONIUM](https://attack.mitre.org/groups/G0128) has used a tool to capture the username on a compromised host in order to register it with C2.(Cita... |
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) used [Remexi](https://attack.mitre.org/software/S0375) to collect usernames from the system.(Citation: ... |
| G0067 | APT37 | [APT37](https://attack.mitre.org/groups/G0067) identifies the victim username.(Citation: Talos Group123) |
| G0049 | OilRig | [OilRig](https://attack.mitre.org/groups/G0049) has run <code>whoami</code> on a victim.(Citation: Palo Alto OilRig May 2016)(Citation: Palo Alto OilR... |
Associated Software (196)
| ID | Name | Type | Context |
|---|---|---|---|
| S0266 | TrickBot | Malware | [TrickBot](https://attack.mitre.org/software/S0266) can identify the user and groups the user belongs to on a compromised host.(Citation: Cyberreason ... |
| S0139 | PowerDuke | Malware | [PowerDuke](https://attack.mitre.org/software/S0139) has commands to get the current user's name and SID.(Citation: Volexity PowerDuke November 2016) |
| S0662 | RCSession | Malware | [RCSession](https://attack.mitre.org/software/S0662) can gather system owner information, including user and administrator privileges.(Citation: Profe... |
| S0543 | Spark | Malware | [Spark](https://attack.mitre.org/software/S0543) has run the whoami command and has a built-in command to identify the user logged in.(Citation: Unit4... |
| S0242 | SynAck | Malware | [SynAck](https://attack.mitre.org/software/S0242) gathers user names from infected hosts.(Citation: SecureList SynAck Doppelgänging May 2018) |
| S1039 | Bumblebee | Malware | [Bumblebee](https://attack.mitre.org/software/S1039) has the ability to identify the user name.(Citation: Google EXOTIC LILY March 2022) |
| S1025 | Amadey | Malware | [Amadey](https://attack.mitre.org/software/S1025) has collected the user name from a compromised host using `GetUserNameA`.(Citation: BlackBerry Amade... |
| S0353 | NOKKI | Malware | [NOKKI](https://attack.mitre.org/software/S0353) can collect the username from the victim’s machine.(Citation: Unit 42 NOKKI Sept 2018) |
| S0248 | yty | Malware | [yty](https://attack.mitre.org/software/S0248) collects the victim’s username.(Citation: ASERT Donot March 2018) |
| S0093 | Backdoor.Oldrea | Malware | [Backdoor.Oldrea](https://attack.mitre.org/software/S0093) collects the current username from the victim.(Citation: Symantec Dragonfly) |
| S9029 | IronWind | Malware | [IronWind](https://attack.mitre.org/software/S9029) can enumerate the username on victim's systems.(Citation: Check Point Wirte NOV 2024) |
| S0460 | Get2 | Malware | [Get2](https://attack.mitre.org/software/S0460) has the ability to identify the current username of an infected host.(Citation: Proofpoint TA505 Octob... |
| S0184 | POWRUNER | Malware | [POWRUNER](https://attack.mitre.org/software/S0184) may collect information about the currently logged in user by running <code>whoami</code> on a vic... |
| S1075 | KOPILUWAK | Malware | [KOPILUWAK](https://attack.mitre.org/software/S1075) can conduct basic network reconnaissance on the victim machine with `whoami`, to get user details... |
| S0362 | Linux Rabbit | Malware | [Linux Rabbit](https://attack.mitre.org/software/S0362) opens a socket on port 22 and if it receives a response it attempts to obtain the machine's ho... |
| S0401 | Exaramel for Linux | Malware | [Exaramel for Linux](https://attack.mitre.org/software/S0401) can run <code>whoami</code> to identify the system owner.(Citation: ANSSI Sandworm Janua... |
| S0391 | HAWKBALL | Malware | [HAWKBALL](https://attack.mitre.org/software/S0391) can collect the user name of the system.(Citation: FireEye HAWKBALL Jun 2019) |
| S0153 | RedLeaves | Malware | [RedLeaves](https://attack.mitre.org/software/S0153) can obtain information about the logged on user both locally and for Remote Desktop sessions.(Cit... |
| S0171 | Felismus | Malware | [Felismus](https://attack.mitre.org/software/S0171) collects the current username and sends it to the C2 server.(Citation: Forcepoint Felismus Mar 201... |
| S1229 | Havoc | Malware | [Havoc](https://attack.mitre.org/software/S1229) can trigger exection of `whoami` on the target host to display the current user.(Citation: Zscaler Ha... |
References
- Cisco. (2023, March 7). Cisco IOS Security Command Reference: Commands S to Z . Retrieved July 13, 2022.
- US-CERT. (2018, April 20). Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
Frequently Asked Questions
What is T1033 (System Owner/User Discovery)?
T1033 is a MITRE ATT&CK technique named 'System Owner/User Discovery'. It belongs to the Discovery tactic(s). Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example,...
How can T1033 be detected?
Detection of T1033 (System Owner/User Discovery) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1033?
Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.
Which threat groups use T1033?
Known threat groups using T1033 include: APT38, GALLIUM, APT3, Kimsuky, Volt Typhoon, Patchwork, APT41, Dragonfly.