Allow root user to run 'T1087.001: Account Discovery: Local Account - List opened files by user' by updating how current username is determined

atomics/T1087.001/T1087.001.md

@@ -146,7 +146,7 @@ List opened files by user
 
 
 ```sh
-username=$(echo $HOME | awk -F'/' '{print $3}') && lsof -u $username
+username=$(id -u -n) && lsof -u $username
 ```
 
 

atomics/T1087.001/T1087.001.yaml

@@ -68,7 +68,7 @@ atomic_tests:
   - macos
   executor:
     command: |
-      username=$(echo $HOME | awk -F'/' '{print $3}') && lsof -u $username
+      username=$(id -u -n) && lsof -u $username
     name: sh
 - name: Show if a user account has ever logged in remotely
   auto_generated_guid: 0f0b6a29-08c3-44ad-a30b-47fd996b2110