diff --git a/atomics/T1087.001/T1087.001.md b/atomics/T1087.001/T1087.001.md
index 7bf13c1d..90865c99 100644
--- a/atomics/T1087.001/T1087.001.md
+++ b/atomics/T1087.001/T1087.001.md
@@ -146,7 +146,7 @@ List opened files by user
 
 
 ```sh
-username=$(echo $HOME | awk -F'/' '{print $3}') && lsof -u $username
+username=$(id -u -n) && lsof -u $username
 ```
 
 
diff --git a/atomics/T1087.001/T1087.001.yaml b/atomics/T1087.001/T1087.001.yaml
index 47c21646..ed6c67e3 100644
--- a/atomics/T1087.001/T1087.001.yaml
+++ b/atomics/T1087.001/T1087.001.yaml
@@ -68,7 +68,7 @@ atomic_tests:
   - macos
   executor:
     command: |
-      username=$(echo $HOME | awk -F'/' '{print $3}') && lsof -u $username
+      username=$(id -u -n) && lsof -u $username
     name: sh
 - name: Show if a user account has ever logged in remotely
   auto_generated_guid: 0f0b6a29-08c3-44ad-a30b-47fd996b2110