T1033.md

T1033 - System Owner/User Discovery

Description from ATT&CK

### Windows

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using Credential Dumping. The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs.

Mac

On Mac, the currently logged in user can be identified with users,w, and who.

Linux

On Linux, the currently logged in user can be identified with w and who.

Atomic Tests

• Atomic Test #1 - System Owner/User Discovery

• Atomic Test #2 - System Owner/User Discovery

Atomic Test #1 - System Owner/User Discovery

Identify System owner or users on an endpoint

Supported Platforms: Windows

Inputs

Name	Description	Type	Default Value
computer_name	Name of remote computer	string	computer1

Run it with command_prompt!

cmd.exe /C whoami
wmic useraccount get /ALL
quser /SERVER:"#{computer_name}"
quser
qwinsta.exe" /server:#{computer_name}
qwinsta.exe
for /F "tokens=1,2" %i in ('qwinsta /server:#{computer_name} ^| findstr "Active Disc"') do @echo %i | find /v "#" | find /v "console" || echo %j > usernames.txt
@FOR /F %n in (computers.txt) DO @FOR /F "tokens=1,2" %i in ('qwinsta /server:%n ^| findstr "Active Disc"') do @echo %i | find /v "#" | find /v "console" || echo %j > usernames.txt

Atomic Test #2 - System Owner/User Discovery

Identify System owner or users on an endpoint

Supported Platforms: Linux, macOS

Run it with sh!

users
w
who