Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping. The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Various utilities and commands may acquire this information, including
whoami. In macOS and Linux, the currently logged in user can be identified with
who. On macOS the
dscl . list /Users | grep -v '_' command can also be used to enumerate user accounts. Environment variables, such as
$USER, may also be used to access this information.
On network devices, Network Device CLI commands such as
show users and
show ssh can be used to display users currently logged into the device.
Action RAT has the ability to collect the username from an infected host.
Agent Tesla can collect the username from the victim’s machine.
Agent.btz obtains the victim username and saves it to a file.
Amadey has collected the user name from a compromised host using
APT19 used an HTTP malware variant and a Port 22 malware variant to collect the victim’s username.
An APT3 downloader uses the Windows command
APT32 collected the victim's username and executed the
APT38 has identified primary users, currently logged in users, sets of users that commonly use a system, or inactive users.
APT41 used the WMIEXEC utility to execute
Aria-body has the ability to identify the username on a compromised host.
AuTo Stealer has the ability to collect the username from an infected host.
Azorult can collect the username from the victim’s machine.
Backdoor.Oldrea collects the current username from the victim.
BISCUIT has a command to gather the username from the system.
BlackCat can utilize
BloodHound can collect information on user sessions.
BLUELIGHT can collect the username on a compromised host.
Bonadan has discovered the username of the user running the backdoor.
BoomBox can enumerate the username on a compromised host.
During C0017, APT41 used
During C0018, the threat actors collected
Cardinal RAT can collect the username from a victim machine.
Caterpillar WebShell can obtain a list of user accounts from a victim's machine.
Chaes has collected the username and UID from the infected machine.
Chimera has used the
Chrommme can retrieve the username from a targeted system.
Clambling can identify the username on a compromised host.
CreepySnail can execute
Crimson can identify the user on a targeted system.
Cryptoistic can gather data on the user of a compromised host.
DarkComet gathers the username from the victim’s machine.
DarkWatchman has collected the username from a victim machine.
Denis enumerates and collects the username from the victim’s machine.
A Linux version of Derusbi checks if the victim user ID is anything other than zero (normally used for root), and the malware will not execute if it does not have root privileges. Derusbi also gathers the username of the victim.
Diavol can collect the username from a compromised host.
DnsSystem can use the Windows user name to create a unique identification for infected users and systems.
DownPaper collects the victim username and sends it to the C2 server.
DRATzarus can obtain a list of users from an infected machine.
Dyre has the ability to identify the users on a compromised host.
Earth Lusca collected information on user accounts via the
Egregor has used tools to gather information about users.
EVILNUM can obtain the username from the victim's machine.
|S0401||Exaramel for Linux||
Exaramel for Linux can run
Explosive has collected the username from the infected host.
Felismus collects the current username and sends it to the C2 server.
FELIXROOT collects the username from the victim’s machine.
FIN10 has used Meterpreter to enumerate users on remote systems.
Flagpro has been used to run the
FlawedAmmyy enumerates the current user during the initial infection.
During Frankenstein, the threat actors used Empire to enumerate hosts and gather username, machine name, and administrative permissions information.
FunnyDream has the ability to gather user information from the targeted system using
A Gamaredon Group file stealer can gather the victim's username to send to a C2 server.
Gelsemium has the ability to distinguish between a standard user and an administrator on a compromised host.
Get2 has the ability to identify the current username of an infected host.
Gold Dragon collects the endpoint victim's username and uses it as a basis for downloading additional components from the C2 server.
Goopy has the ability to enumerate the infected system's user name.
Grandoreiro can collect the username from the victim's machine.
GravityRAT collects the victim username along with other account information (account type, description, full name, SID and status).
can collect the victim user name.
HEXANE has run
HotCroissant has the ability to collect the username on the infected host.
InvisiMole lists local users and session information.
Ke3chang has used implants capable of collecting the signed-in username.
Koadic can identify logged in users across the domain and views user sessions.
The OsInfo function in Komplex collects the current running username.
KONNI can collect the username from the victim’s machine.
Kwampirs collects registered owner details by using the commands
Various Lazarus Group malware enumerates logged-on users.
Linux Rabbit opens a socket on port 22 and if it receives a response it attempts to obtain the machine's hostname and Top-Level Domain. 
LiteDuke can enumerate the account name on a targeted system.
LitePower can determine if the current user has admin privileges.
Lokibot has the ability to discover the username on the infected host.
Lucifer has the ability to identify the username on a compromised host.
LuminousMoth has used a malicious DLL to collect the username from compromised hosts.
MacMa can collect the username from the compromised machine.
Mafalda can collect the username from a compromised host.
Magic Hound malware has obtained the victim username and sent it to the C2 server.
MechaFlounder has the ability to identify the username and hostname on a compromised host.
metaMain can collect the username from a compromised host.
Metamorfo has collected the username from the victim's machine.
Micropsia collects the username from the victim’s machine.
Milan can identify users registered to a targeted machine.
MirageFox can gather the username from the victim’s machine.
Mis-Type runs tests to determine the privilege level of the compromised user.
More_eggs has the capability to gather the username from the victim's machine.
MuddyWater has used malware that can collect the victim’s username.
NDiskMonitor obtains the victim username and encrypts the information to send over its C2 channel.
Neoichor can collect the user name from a victim's machine.
During Night Dragon, threat actors used password cracking and pass-the-hash tools to discover usernames and passwords.
njRAT enumerates the current user during the initial infection.
NOKKI can collect the username from the victim’s machine.
ObliqueRAT can check for blocklisted usernames on infected endpoints.
Octopus can collect the username from the victim’s machine.
During Operation CuckooBees, the threat actors used the
During Operation Wocao, threat actors enumerated sessions and users on a remote host, and identified privileged users logged into a targeted system.
Patchwork collected the victim username and whether it was running as admin, then sent the information to its C2 server.
PoetRAT sent username, computer name, and the previously generated UUID in reply to a "who" command from C2.
PowerDuke has commands to get the current user's name and SID.
PowerShower has the ability to identify the current user on the infected host.
POWERSTATS has the ability to identify the username on the compromised host.
POWRUNER may collect information about the currently logged in user by running
A module in Prikormka collects information from the victim about the current user name.
Pupy can enumerate local information for Linux hosts and find currently logged on users for Windows hosts.
PyDCrypt has probed victim machines with
QakBot can identify the user name on a compromised system.
RCSession can gather system owner information, including user and administrator privileges.
RedLeaves can obtain information about the logged on user both locally and for Remote Desktop sessions.
Revenge RAT gathers the username from the system.
Rifdoor has the ability to identify the username on the compromised host.
Rising Sun can detect the username of the infected host.
RogueRobin collects the victim’s username and whether that user is an admin.
ROKRAT can collect the username from a compromised host.
S-Type has run tests to determine the privilege level of the compromised user.
Saint Bot can collect the username from a compromised host.
Sandworm Team has collected the username from a compromised host.
SDBbot has the ability to identify the user on a compromised host.
ServHelper will attempt to enumerate the username of the victim.
ShadowPad has collected the username of the victim system.
SHARPSTATS has the ability to identify the username on the compromised host.
SideTwist can collect the username on a targeted system.
Sidewinder has used tools to identify the user of a compromised host.
SILENTTRINITY can gather a list of logged on users.
SLOTHFULMEDIA has collected the username from a victim machine.
Small Sieve can obtain the id of a logged in user.
SMOKEDHAM has used
SodaMaster can identify the username on a compromised host.
SombRAT can execute
Spark has run the whoami command and has a built-in command to identify the user logged in.
Squirrelwaffle can collect the user name from a compromised host.
SslMM sends the logged-on username to its hard-coded C2.
STARWHALE can gather the username from an infected host.
Stealth Falcon malware gathers the registered user and primary owner name via WMI.
StrifeWater can collect the user name from the victim's machine.
SUNBURST collected the username from a compromised host.
SVCReady can collect the username from an infected host.
Sys10 collects the account name of the logged-in user and sends it to the C2.
SysUpdate can collect the username from a compromised host.
T9000 gathers and beacons the username of the logged in account during installation. It will also gather the username of running processes to determine if it is running as SYSTEM.
Threat Group-3390 has used
TrickBot can identify the user and groups the user belongs to on a compromised host.
Trojan.Karagany can gather information about the user on a compromised host.
Tropic Trooper used
Unknown Logger can obtain information about the victim usernames.
UPPERCUT has the capability to collect the current logged on user’s username from a machine.
WellMail can identify the current username on the victim system.
WellMess can collect the username on the victim machine to send to C2.
WINDSHIELD can gather the victim user name.
Windshift has used malware to identify the username on a compromised host.
WinMM uses NetUser-GetInfo to identify that it is running under an "Admin" account on the local system.
Wizard Spider has used "whoami" to identify the local user and their privileges.
Woody RAT can retrieve a list of user accounts and usernames from an infected machine.
XAgentOSX contains the getInfoOSX function to return the OS X version as well as the current user.
ZIRCONIUM has used a tool to capture the username on a compromised host in order to register it with C2.
zwShell can obtain the name of the logged-in user on the victim.
ZxShell can collect the owner and organization information from the target workstation.
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
|ID||Data Source||Data Component||Detects|
|DS0026||Active Directory||Active Directory Object Access||
Monitor domain controller logs for replication requests and other unscheduled activity possibly associated with DCSync.    Note: Domain controllers may not log replication requests originating from the default domain controller account. . Monitor for replication requests  from IPs not associated with known domain controllers. 
Monitor executed commands and arguments that may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Look for command-lines that invoke AuditD or the Security Accounts Manager (SAM). Remote access tools may contain built-in features or incorporate existing tools like Mimikatz. PowerShell scripts also exist that contain credential dumping functionality, such as PowerSploit's Invoke-Mimikatz module,  which may require additional logging features to be configured in the operating system to collect necessary information for analysis.
Monitor for hash dumpers opening the Security Accounts Manager (SAM) on the local file system (
|DS0029||Network Traffic||Network Traffic Content||
Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).
|Network Traffic Flow||
Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.
|DS0009||Process||OS API Execution||
Monitor for API calls that may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software.
Monitor for unexpected processes interacting with lsass.exe. Common credential dumpers such as Mimikatz access the LSA Subsystem Service (LSASS) process by opening the process, locating the LSA secrets key, and decrypting the sections in memory where credential details are stored. Credential dumpers may also use methods for reflective Process Injection to reduce potential indicators of malicious activity.
To obtain the passwords and hashes stored in memory, processes must open a maps file in the /proc filesystem for the process being analyzed. This file is stored under the path
Monitor for newly executed processes that may be indicative of credential dumping. On Windows 8.1 and Windows Server 2012 R2, monitor Windows Logs for LSASS.exe creation to verify that LSASS started as a protected process.
|DS0024||Windows Registry||Windows Registry Key Access||
Monitor for the SAM registry key being accessed that may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software.