Skip to content
Permalink
Branch: master
Find file Copy path
Find file Copy path
CircleCI Atomic Red Team doc generator Generate docs from job=validate_atomics_generate_docs branch=master 6965fc1 Nov 14, 2018
0 contributors

Users who have contributed to this file

62 lines (42 sloc) 2.15 KB

T1033 - System Owner/User Discovery

Description from ATT&CK

### Windows

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using Credential Dumping. The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs.

Mac

On Mac, the currently logged in user can be identified with users,w, and who.

Linux

On Linux, the currently logged in user can be identified with w and who.

Atomic Tests


Atomic Test #1 - System Owner/User Discovery

Identify System owner or users on an endpoint

Supported Platforms: Windows

Inputs

Name Description Type Default Value
computer_name Name of remote computer string computer1

Run it with command_prompt!

cmd.exe /C whoami
wmic useraccount get /ALL
quser /SERVER:"#{computer_name}"
quser
qwinsta.exe" /server:#{computer_name}
qwinsta.exe
for /F "tokens=1,2" %i in ('qwinsta /server:#{computer_name} ^| findstr "Active Disc"') do @echo %i | find /v "#" | find /v "console" || echo %j > usernames.txt
@FOR /F %n in (computers.txt) DO @FOR /F "tokens=1,2" %i in ('qwinsta /server:%n ^| findstr "Active Disc"') do @echo %i | find /v "#" | find /v "console" || echo %j > usernames.txt


Atomic Test #2 - System Owner/User Discovery

Identify System owner or users on an endpoint

Supported Platforms: Linux, macOS

Run it with sh!

users
w
who

You can’t perform that action at this time.