atomic-red-team/atomics/T1033/T1033.md

T1033 - System Owner/User Discovery

Description from ATT&CK

### Windows

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using Credential Dumping. The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Mac

On Mac, the currently logged in user can be identified with users,w, and who.

Linux

On Linux, the currently logged in user can be identified with w and who.

Atomic Tests

• Atomic Test #1 - System Owner/User Discovery

• Atomic Test #2 - System Owner/User Discovery

Atomic Test #1 - System Owner/User Discovery

Identify System owner or users on an endpoint

Supported Platforms: Windows

Inputs

Name	Description	Type	Default Value
computer_name	Name of remote computer	string	computer1

Run it with command_prompt!

cmd.exe /C whoami
wmic useraccount get /ALL
quser /SERVER:"#{computer_name}"
quser
qwinsta.exe" /server:#{computer_name}
qwinsta.exe
for /F "tokens=1,2" %i in ('qwinsta /server:#{computer_name} ^| findstr "Active Disc"') do @echo %i | find /v "#" | find /v "console" || echo %j > usernames.txt
@FOR /F %n in (computers.txt) DO @FOR /F "tokens=1,2" %i in ('qwinsta /server:%n ^| findstr "Active Disc"') do @echo %i | find /v "#" | find /v "console" || echo %j > usernames.txt

Atomic Test #2 - System Owner/User Discovery

Identify System owner or users on an endpoint

Supported Platforms: Linux, macOS

Run it with sh!

users
w
who