T1033 System Owner/User Discovery

Technique

T1033

Tactics

Discovery

Research, 90 days

5

KEV CVEs mapped

2

SigmaHQ rules

30

Elastic, Splunk

37

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1033

MITRE description

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Various utilities and commands may acquire this information, including <code>whoami</code>. In macOS and Linux, the currently logged in user can be identified with <code>w</code> and <code>who</code>. On macOS the <code>dscl . list /Users | grep -v '_'</code> command can also be used to enumerate user accounts. Environment variables, such as <code>%USERNAME%</code> and <code>$USER</code>, may also be used to access this information. On network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show users` and `show ssh` can be used to display users currently logged into the device.(Citation: show_ssh_users_cmd_cisco)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

• CVE-2024-4577
• CVE-2023-22518

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-22 Group-IB: Inside SiriusQT: A Seriously Skilled RAT
• 2026-10-15 Google Threat Intelligence: Investigating Ephemeral Supply Chain Tampering
• 2026-10-14 Group-IB: KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
• 2026-10-06 Flare: CrocoRat Adds a New Twist to ClickFix with DNS Payload Delivery
• 2026-09-17 ESET: Beware the SparroWock: The backdoor that bites, the commands that catch

Detection coverage

SigmaHQ community rules

• Potential Dridex Activity (emerging-threats)
• Possible DCSync Attack (core)
• SharpHound Recon Sessions (core)
• System Owner or User Discovery - Linux (core)
• ESXi Network Configuration Discovery Via ESXCLI (core)
• ESXi Storage Information Discovery Via ESXCLI (core)
• ESXi System Information Discovery Via ESXCLI (core)
• ESXi VM List Discovery Via ESXCLI (core)
• ESXi VSAN Information Discovery Via ESXCLI (core)
• Cisco Discovery (core)
• Get-ADUser Enumeration Using UserAccountControl Flags (core)
• Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell (core)
• Suspicious PowerShell Get Current User (core)
• User Discovery And Export Via Get-ADUser Cmdlet - PowerShell (core)
• HackTool - SharpLdapWhoami Execution (core)
• HackTool - SharpView Execution (core)
• Computer Discovery And Export Via Get-ADComputer Cmdlet (core)
• User Discovery And Export Via Get-ADUser Cmdlet (core)
• Renamed Whoami Execution (core)
• Local Accounts Discovery (core)
• WhoAmI as Parameter (core)
• Chopper Webshell Process Pattern (core)
• Webshell Hacking Activity Patterns (core)
• Webshell Detection With Command Line Keywords (core)
• Enumerate All Information With Whoami.EXE (core)

Showing 25 of 30 community rules. the full set is tagged attack.t1033 in SigmaHQ.

Elastic and Splunk rules

• Suspicious React Server Child Process (elastic)
• Shell or Suspicious Process Spawned by Ray Worker (elastic)
• AWS STS GetCallerIdentity API Called for the First Time (elastic)
• AWS STS GetCallerIdentity Bulk Account Enumeration (elastic)
• Privilege Boundary Enumeration Detected via Defend for Containers (elastic)
• Potentially Suspicious Process Started via tmux or screen (elastic)
• Passwordless Sudo Probing (elastic)
• Sudo Command Enumeration Detected (elastic)
• Unusual User Privilege Enumeration via id (elastic)
• Suspicious System Commands Executed by Previously Unknown Executable (elastic)
• Discovery Command Output Written to Suspicious File (elastic)
• Unusual Linux User Discovery Activity (elastic)
• Account Discovery Command via SYSTEM Account (elastic)
• PowerShell Suspicious Discovery Related Windows API Functions (elastic)
• Whoami Process Activity (elastic)
• Enumeration Command Spawned via WMIPrvSE (elastic)
• Suspicious PDF Reader Child Process (elastic)
• Suspicious JetBrains TeamCity Child Process (elastic)
• Suspicious MS Office Child Process (elastic)
• Windows Account or Group Discovery (elastic)
• System Owner/User Discovery Linux (elastic)
• Check Elevated CMD using whoami (splunk)
• GetCurrent User with PowerShell (splunk)
• GetCurrent User with PowerShell Script Block (splunk)
• Linux Auditd Whoami User Discovery (splunk)

Showing 25 of 37.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.