System Owner/User Discovery T1033

Events covered

10 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 78 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (43 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Top indicator values (704 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Exclusions (174 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 30 rules

• Chopper Webshell Process Pattern
• Cisco Discovery
• Computer Discovery And Export Via Get-ADComputer Cmdlet
• Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell
• Enumerate All Information With Whoami.EXE
• ESXi Network Configuration Discovery Via ESXCLI
• ESXi Storage Information Discovery Via ESXCLI
• ESXi System Information Discovery Via ESXCLI
• ESXi VM List Discovery Via ESXCLI
• ESXi VSAN Information Discovery Via ESXCLI
• Get-ADUser Enumeration Using UserAccountControl Flags
• Group Membership Reconnaissance Via Whoami.EXE
• HackTool - SharpLdapWhoami Execution
• HackTool - SharpView Execution
• Local Accounts Discovery
• Possible DCSync Attack
• Potential Dridex Activity
• Renamed Whoami Execution
• Security Privileges Enumeration Via Whoami.EXE
• SharpHound Recon Sessions
• Suspicious PowerShell Get Current User
• System Owner or User Discovery - Linux
• User Discovery And Export Via Get-ADUser Cmdlet
• User Discovery And Export Via Get-ADUser Cmdlet - PowerShell
• Webshell Detection With Command Line Keywords
• Webshell Hacking Activity Patterns
• WhoAmI as Parameter
• Whoami.EXE Execution Anomaly
• Whoami.EXE Execution From Privileged Process
• Whoami.EXE Execution With Output Option

Elastic 19 rules

• Account Discovery Command via SYSTEM Account
• AWS STS GetCallerIdentity API Called for the First Time
• Discovery Command Output Written to Suspicious File
• Enumeration Command Spawned via WMIPrvSE
• Interactive Privilege Boundary Enumeration Detected via Defend for Containers
• Passwordless Sudo Probing
• Potentially Suspicious Process Started via tmux or screen
• PowerShell Suspicious Discovery Related Windows API Functions
• Sudo Command Enumeration Detected
• Suspicious JetBrains TeamCity Child Process
• Suspicious MS Office Child Process
• Suspicious PDF Reader Child Process
• Suspicious React Server Child Process
• Suspicious System Commands Executed by Previously Unknown Executable
• System Owner/User Discovery Linux
• Unusual Linux User Discovery Activity
• Unusual User Privilege Enumeration via id
• Whoami Process Activity
• Windows Account or Group Discovery

Splunk 25 rules

• Check Elevated CMD using whoami
• Common Recon Commands in Short Burst (Sysmon)
• Common Recon Commands in Short Burst (Windows Event Log)
• Common Reconnaissance Commands (PowerShell)
• Common Reconnaissance Commands (Sysmon)
• Common Reconnaissance Commands (Windows Event Log)
• GetCurrent User with PowerShell
• GetCurrent User with PowerShell Script Block
• Linux Auditd Whoami User Discovery
• PowerView_SharpView Commands (PowerShell)
• System Owner_User Discovery - Windows (PowerShell)
• System Owner_User Discovery - Windows (Sysmon)
• System Owner_User Discovery - Windows (Windows Event Log)
• System User Discovery With Query
• System User Discovery With Whoami
• User Discovery via Environment Variables - PowerShell (PowerShell)
• User Discovery With Env Vars PowerShell
• User Discovery With Env Vars PowerShell Script Block
• Windows Common Abused Cmd Shell Risk Behavior
• Windows System Discovery Using ldap Nslookup
• Windows System Discovery Using Qwinsta
• Windows System Remote Discovery With Query
• Windows System User Discovery Via Quser
• Windows System User Privilege Discovery
• Windows WinPEAS PowerShell Script Execution

Kusto 1 rule

• LDAP reconnaissance via search filters

YARA-L 3 rules

• Local Accounts Discovery
• MITRE ATT&CK T1033 Recon Successful Logon Enumeration Powershell CISA Report
• Whoami Execution