Michael Haag
87743faf73
+ Added a Discovery bat file to run all the things at once. Generally, none of this activity is deemed "evil" as it is recon activity. Seeing it all run at once should be suspect to anyone. + Updates to two discovery files.
357 B
357 B
System Owner/User Discovery
MITRE ATT&CK Technique: T1018
cmd.exe
"cmd.exe" /C whoami
wmic.exe
wmic useraccount get /ALL
quser
Remote:
quser /SERVER:"<computername>"
Local:
quser
qwinsta
Remote:
qwinsta.exe" /server:<computername>
Local:
qwinsta.exe