{"id":"T1033","name":"System Owner/User Discovery","url":"https://attack.mitre.org/techniques/T1033","tactics":["discovery"],"platforms":["Linux","macOS","Network Devices","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0093","stix_id":"x-mitre-detection-strategy--050d236f-745a-4801-add6-50cb58248615","name":"Behavioral Detection of User Discovery via Local and Remote Enumeration","url":"https://attack.mitre.org/detectionstrategies/DET0093","analytics":[{"id":"AN0254","stix_id":"x-mitre-analytic--5d024a50-97d8-4b81-8cc6-3db4fff2712c","name":"Analytic 0254","description":"Adversary launches built-in system tools (e.g., whoami, query user, net user) or scripts that enumerate user account information via local execution or remote API queries (e.g., WMI, PowerShell).","url":"https://attack.mitre.org/detectionstrategies/DET0093#AN0254","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"}],"mutable_elements":[{"field":"ParentProcessContext","description":"Identify if enumeration originates from non-interactive shell or system service"},{"field":"TimeWindow","description":"Tune temporal grouping of enumeration + lateral movement attempts"},{"field":"UserContext","description":"Flag unexpected users issuing enumeration commands (e.g., service accounts)"}],"live":true,"detection_strategies":["DET0093"],"techniques":["T1033"]},{"id":"AN0255","stix_id":"x-mitre-analytic--73b31f73-bc47-45c1-9c02-fd8eaacb2f9b","name":"Analytic 0255","description":"Adversary runs commands like `whoami`, `id`, `w`, or `cat /etc/passwd` from non-interactive or scripting contexts to enumerate system user details.","url":"https://attack.mitre.org/detectionstrategies/DET0093#AN0255","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"CommandLineRegex","description":"Tune detection based on argument presence (e.g., `cat /etc/passwd` vs. `cat` alone)"},{"field":"ShellContext","description":"Identify if command issued via cron, systemd, or reverse shell"},{"field":"AccessFrequency","description":"Define how often user/account commands are expected on endpoint"}],"live":true,"detection_strategies":["DET0093"],"techniques":["T1033"]},{"id":"AN0256","stix_id":"x-mitre-analytic--0979e7f1-9d0a-4549-be8f-88979df5c8d7","name":"Analytic 0256","description":"Adversary uses `dscl`, `who`, or environment variables like `$USER` to identify accounts or sessions via Terminal or malicious LaunchAgents.","url":"https://attack.mitre.org/detectionstrategies/DET0093#AN0256","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"subsystem:com.apple.Terminal","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"},{"name":"macos:endpointsecurity","channel":"ES_EVENT_TYPE_NOTIFY_EXEC","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-endpointsecurity"}],"mutable_elements":[{"field":"LaunchAgentPersistence","description":"Correlate dscl usage with known persistence vectors"},{"field":"CommandExecutionPath","description":"Distinguish between user-initiated terminal vs. script execution"},{"field":"UsernameEnumerationPattern","description":"Regex-based pattern tuning for `dscl . -list /Users` + grep filters"}],"live":true,"detection_strategies":["DET0093"],"techniques":["T1033"]},{"id":"AN0257","stix_id":"x-mitre-analytic--a5cc0eac-af18-4fe2-ac06-88a5cfddf014","name":"Analytic 0257","description":"Adversary executes CLI commands like `show users`, `show ssh`, or attempts to dump AAA user lists from routers or switches.","url":"https://attack.mitre.org/detectionstrategies/DET0093#AN0257","platforms":["Network Devices"],"log_source_references":[{"name":"networkdevice:syslog","channel":"aaa privilege_exec","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"networkdevice-syslog"},{"name":"networkdevice:syslog","channel":"eventlog","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"networkdevice-syslog"}],"mutable_elements":[{"field":"CLICommandBaseline","description":"Expected command set per device role/user role combination"},{"field":"DeviceRoleSensitivity","description":"Correlate access with core vs. edge vs. management plane sensitivity"},{"field":"CommandFrequencyThreshold","description":"Detect burst usage of `show` or `debug` commands by non-admin users"}],"live":true,"detection_strategies":["DET0093"],"techniques":["T1033"]}],"live":true,"version":"1.0","techniques":["T1033"]}],"sigma_rules":[{"id":"1114e048-b69c-4f41-bc20-657245ae6e3f","title":"User Discovery And Export Via Get-ADUser Cmdlet","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-09-09","modified":"2022-11-17","description":"Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file","references":["http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html","https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1033"],"path":"rules/windows/process_creation/proc_creation_win_powershell_user_discovery_get_aduser.yml","techniques":["T1033"],"cves":[]},{"id":"33e814e0-1f00-4e43-9c34-31fb7ae2b174","title":"ESXi Network Configuration Discovery Via ESXCLI","author":"Cedric Maurugeon","status":"test","level":"medium","date":"2023-09-04","modified":null,"description":"Detects execution of the \"esxcli\" command with the \"network\" flag in order to retrieve information about the network configuration.","references":["https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/","https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_network.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.execution","attack.t1033","attack.t1007","attack.t1059.012"],"path":"rules/linux/process_creation/proc_creation_lnx_esxcli_network_discovery.yml","techniques":["T1033","T1007","T1059.012"],"cves":[]},{"id":"4096a49c-7de4-4da0-a230-c66ccd56ea5a","title":"Suspicious PowerShell Get Current User","author":"frack113","status":"test","level":"low","date":"2022-04-04","modified":null,"description":"Detects the use of PowerShell to identify the current logged user.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md#atomic-test-4---user-discovery-with-env-vars-powershell-script","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md#atomic-test-5---getcurrent-user-with-powershell-script"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.discovery","attack.t1033"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_get_current_user.yml","techniques":["T1033"],"cves":[]},{"id":"435e10e4-992a-4281-96f3-38b11106adde","title":"Computer Discovery And Export Via Get-ADComputer Cmdlet","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-11-10","modified":"2022-11-17","description":"Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file","references":["http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html","https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/","https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1033"],"path":"rules/windows/process_creation/proc_creation_win_powershell_computer_discovery_get_adcomputer.yml","techniques":["T1033"],"cves":[]},{"id":"4ebc877f-4612-45cb-b3a5-8e3834db36c9","title":"Webshell Hacking Activity Patterns","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-03-17","modified":"2023-11-09","description":"Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system\n","references":["https://youtu.be/7aemGhaE9ds?t=641"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.discovery","attack.t1505.003","attack.t1018","attack.t1033","attack.t1087"],"path":"rules/windows/process_creation/proc_creation_win_webshell_hacking.yml","techniques":["T1505.003","T1018","T1033","T1087"],"cves":[]},{"id":"502b42de-4306-40b4-9596-6f590c81f073","title":"Local Accounts Discovery","author":"Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community","status":"test","level":"low","date":"2019-10-21","modified":"2025-10-20","description":"Local accounts, System Owner/User discovery using operating systems utilities","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1033","attack.t1087.001"],"path":"rules/windows/process_creation/proc_creation_win_susp_local_system_owner_account_discovery.yml","techniques":["T1033","T1087.001"],"cves":[]},{"id":"56fda488-113e-4ce9-8076-afc2457922c3","title":"Possible DCSync Attack","author":"Sagie Dulce, Dekel Paz","status":"test","level":"high","date":"2022-01-01","modified":null,"description":"Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.","references":["https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47?redirectedfrom=MSDN","https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-DRSR.md","https://github.com/zeronetworks/rpcfirewall","https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/"],"logsource":{"product":"rpc_firewall","category":"application"},"tags":["attack.t1033","attack.discovery"],"path":"rules/application/rpc_firewall/rpc_firewall_dcsync_attack.yml","techniques":["T1033"],"cves":[]},{"id":"5f1573a7-363b-4114-9208-ad7a61de46eb","title":"ESXi VM List Discovery Via ESXCLI","author":"Cedric Maurugeon","status":"test","level":"medium","date":"2023-09-04","modified":null,"description":"Detects execution of the \"esxcli\" command with the \"vm\" flag in order to retrieve information about the installed VMs.","references":["https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/","https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html","https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/","https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.execution","attack.t1033","attack.t1007","attack.t1059.012"],"path":"rules/linux/process_creation/proc_creation_lnx_esxcli_vm_discovery.yml","techniques":["T1033","T1007","T1059.012"],"cves":[]},{"id":"6d580420-ff3f-4e0e-b6b0-41b90c787e28","title":"SharpHound Recon Sessions","author":"Sagie Dulce, Dekel Paz","status":"test","level":"high","date":"2022-01-01","modified":null,"description":"Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.","references":["https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/02b1f559-fda2-4ba3-94c2-806eb2777183","https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SRVS.md","https://github.com/zeronetworks/rpcfirewall","https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/"],"logsource":{"product":"rpc_firewall","category":"application"},"tags":["attack.discovery","attack.t1033"],"path":"rules/application/rpc_firewall/rpc_firewall_sharphound_recon_sessions.yml","techniques":["T1033"],"cves":[]},{"id":"79ce34ca-af29-4d0e-b832-fc1b377020db","title":"Whoami.EXE Execution From Privileged Process","author":"Florian Roth (Nextron Systems), Teymur Kheirkhabarov","status":"test","level":"high","date":"2022-01-28","modified":"2023-12-04","description":"Detects the execution of \"whoami.exe\" by privileged accounts that are often abused by threat actors","references":["https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment","https://web.archive.org/web/20221019044836/https://nsudo.m2team.org/en-us/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.discovery","attack.t1033"],"path":"rules/windows/process_creation/proc_creation_win_whoami_execution_from_high_priv_process.yml","techniques":["T1033"],"cves":[]},{"id":"8de1cbe8-d6f5-496d-8237-5f44a721c7a0","title":"Whoami.EXE Execution Anomaly","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2021-08-12","modified":"2025-03-06","description":"Detects the execution of whoami.exe with suspicious parent processes.","references":["https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/","https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/","https://www.youtube.com/watch?v=DsJ9ByX84o4&t=6s"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1033","car.2016-03-001"],"path":"rules/windows/process_creation/proc_creation_win_whoami_parent_anomaly.yml","techniques":["T1033"],"cves":[]},{"id":"96c982fe-3d08-4df4-bed2-eb14e02f21c8","title":"Get-ADUser Enumeration Using UserAccountControl Flags","author":"frack113","status":"test","level":"medium","date":"2022-03-17","modified":null,"description":"Detects AS-REP roasting is an attack that is often-overlooked. It is not very common as you have to explicitly set accounts that do not require pre-authentication.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md#atomic-test-11---get-aduser-enumeration-using-useraccountcontrol-flags-as-rep-roasting","https://shellgeek.com/useraccountcontrol-flags-to-manipulate-properties/"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.discovery","attack.t1033"],"path":"rules/windows/powershell/powershell_script/posh_ps_as_rep_roasting.yml","techniques":["T1033"],"cves":[]},{"id":"9705a6a1-6db6-4a16-a987-15b7151e299b","title":"Cisco Discovery","author":"Austin Clark","status":"test","level":"low","date":"2019-08-12","modified":"2023-01-04","description":"Find information about network devices that is not stored in config files","references":["https://www.cisco.com/c/en/us/td/docs/server_nw_virtual/2-5_release/command_reference/show.html"],"logsource":{"product":"cisco","service":"aaa"},"tags":["attack.discovery","attack.t1083","attack.t1201","attack.t1057","attack.t1018","attack.t1082","attack.t1016","attack.t1049","attack.t1033","attack.t1124"],"path":"rules/network/cisco/aaa/cisco_cli_discovery.yml","techniques":["T1083","T1201","T1057","T1018","T1082","T1016","T1049","T1033","T1124"],"cves":[]},{"id":"97a80ec7-0e2f-4d05-9ef4-65760e634f6b","title":"Security Privileges Enumeration Via Whoami.EXE","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-05-05","modified":"2023-02-28","description":"Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privileges. This is often used after a privilege escalation attempt.","references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/whoami"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.discovery","attack.t1033"],"path":"rules/windows/process_creation/proc_creation_win_whoami_priv_discovery.yml","techniques":["T1033"],"cves":[]},{"id":"9a0d8ca0-2385-4020-b6c6-cb6153ca56f3","title":"System Owner or User Discovery - Linux","author":"Timur Zinniatullin, oscd.community","status":"test","level":"low","date":"2019-10-21","modified":"2025-06-04","description":"Detects the execution of host or user discovery utilities such as \"whoami\", \"hostname\", \"id\", etc.\nAdversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.discovery","attack.t1033"],"path":"rules/linux/auditd/execve/lnx_auditd_user_discovery.yml","techniques":["T1033"],"cves":[]},{"id":"b2317cfa-4a47-4ead-b3ff-297438c0bc2d","title":"HackTool - SharpView Execution","author":"frack113","status":"test","level":"high","date":"2021-12-10","modified":"2023-02-14","description":"Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems","references":["https://github.com/tevora-threat/SharpView/","https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-4---system-discovery-using-sharpview"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1049","attack.t1069.002","attack.t1482","attack.t1135","attack.t1033"],"path":"rules/windows/process_creation/proc_creation_win_hktl_sharpview.yml","techniques":["T1049","T1069.002","T1482","T1135","T1033"],"cves":[]},{"id":"bd8b828d-0dca-48e1-8a63-8a58ecf2644f","title":"Group Membership Reconnaissance Via Whoami.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-02-28","modified":null,"description":"Detects the execution of whoami.exe with the /group command line flag to show group membership for the current user, account type, security identifiers (SID), and attributes.","references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/whoami"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1033"],"path":"rules/windows/process_creation/proc_creation_win_whoami_groups_discovery.yml","techniques":["T1033"],"cves":[]},{"id":"bed2a484-9348-4143-8a8a-b801c979301c","title":"Webshell Detection With Command Line Keywords","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson","status":"test","level":"high","date":"2017-01-01","modified":"2026-07-14","description":"Detects certain command line parameters often used during reconnaissance activity via web shells","references":["https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html","https://unit42.paloaltonetworks.com/bumblebee-webshell-xhunt-campaign/","https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.discovery","attack.t1505.003","attack.t1018","attack.t1033","attack.t1087"],"path":"rules/windows/process_creation/proc_creation_win_webshell_recon_commands_and_processes.yml","techniques":["T1505.003","T1018","T1033","T1087"],"cves":[]},{"id":"c248c896-e412-4279-8c15-1c558067b6fa","title":"Enumerate All Information With Whoami.EXE","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-12-04","modified":"2024-03-05","description":"Detects the execution of \"whoami.exe\" with the \"/all\" flag","references":["https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/","https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/","https://www.youtube.com/watch?v=DsJ9ByX84o4&t=6s"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1033","car.2016-03-001"],"path":"rules/windows/process_creation/proc_creation_win_whoami_all_execution.yml","techniques":["T1033"],"cves":[]},{"id":"c2993223-6da8-4b1a-88ee-668b8bf315e9","title":"User Discovery And Export Via Get-ADUser Cmdlet - PowerShell","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-11-17","modified":null,"description":"Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file","references":["http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html","https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.discovery","attack.t1033"],"path":"rules/windows/powershell/powershell_script/posh_ps_user_discovery_get_aduser.yml","techniques":["T1033"],"cves":[]},{"id":"c30fb093-1109-4dc8-88a8-b30d11c95a5d","title":"Whoami.EXE Execution With Output Option","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-02-28","modified":"2023-12-04","description":"Detects the execution of \"whoami.exe\" with the \"/FO\" flag to choose CSV as output format or with redirection options to export the results to a file for later use.","references":["https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/","https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/","https://www.youtube.com/watch?v=DsJ9ByX84o4&t=6s"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1033","car.2016-03-001"],"path":"rules/windows/process_creation/proc_creation_win_whoami_output.yml","techniques":["T1033"],"cves":[]},{"id":"d54c2f06-aca9-4e2b-81c9-5317858f4b79","title":"ESXi VSAN Information Discovery Via ESXCLI","author":"Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon","status":"test","level":"medium","date":"2023-09-04","modified":null,"description":"Detects execution of the \"esxcli\" command with the \"vsan\" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.","references":["https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html","https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html","https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vsan.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.execution","attack.t1033","attack.t1007","attack.t1059.012"],"path":"rules/linux/process_creation/proc_creation_lnx_esxcli_vsan_discovery.yml","techniques":["T1033","T1007","T1059.012"],"cves":[]},{"id":"d9367cbb-c2e0-47ce-bdc0-128cb6da898d","title":"HackTool - SharpLdapWhoami Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-08-29","modified":"2023-02-04","description":"Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller","references":["https://github.com/bugch3ck/SharpLdapWhoami"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1033","car.2016-03-001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_sharpldapwhoami.yml","techniques":["T1033"],"cves":[]},{"id":"db885529-903f-4c5d-9864-28fe199e6370","title":"Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-11-17","modified":null,"description":"Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file","references":["http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html","https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/","https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.discovery","attack.t1033"],"path":"rules/windows/powershell/powershell_script/posh_ps_computer_discovery_get_adcomputer.yml","techniques":["T1033"],"cves":[]},{"id":"e6eb5a96-9e6f-4a18-9cdd-642cfda21c8e","title":"Potential Dridex Activity","author":"Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"stable","level":"critical","date":"2019-01-10","modified":"2023-02-03","description":"Detects potential Dridex acitvity via specific process patterns","references":["https://app.any.run/tasks/993daa5e-112a-4ff6-8b5a-edbcec7c7ba3","https://redcanary.com/threat-detection-report/threats/dridex/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055","attack.discovery","attack.t1135","attack.t1033","detection.emerging-threats"],"path":"rules-emerging-threats/2019/Malware/Dridex/proc_creation_win_malware_dridex.yml","techniques":["T1055","T1135","T1033"],"cves":[]},{"id":"e80273e1-9faf-40bc-bd85-dbaff104c4e9","title":"ESXi System Information Discovery Via ESXCLI","author":"Cedric Maurugeon","status":"test","level":"medium","date":"2023-09-04","modified":null,"description":"Detects execution of the \"esxcli\" command with the \"system\" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.","references":["https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/","https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.execution","attack.t1033","attack.t1007","attack.t1059.012"],"path":"rules/linux/process_creation/proc_creation_lnx_esxcli_system_discovery.yml","techniques":["T1033","T1007","T1059.012"],"cves":[]},{"id":"e9142d84-fbe0-401d-ac50-3e519fb00c89","title":"WhoAmI as Parameter","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-11-29","modified":"2022-12-25","description":"Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)","references":["https://twitter.com/blackarrowsec/status/1463805700602224645?s=12"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1033","car.2016-03-001"],"path":"rules/windows/process_creation/proc_creation_win_susp_whoami_as_param.yml","techniques":["T1033"],"cves":[]},{"id":"f1086bf7-a0c4-4a37-9102-01e573caf4a0","title":"Renamed Whoami Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2021-08-12","modified":"2022-10-09","description":"Detects the execution of whoami that has been renamed to a different name to avoid detection","references":["https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/","https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1033","car.2016-03-001"],"path":"rules/windows/process_creation/proc_creation_win_renamed_whoami.yml","techniques":["T1033"],"cves":[]},{"id":"f41dada5-3f56-4232-8503-3fb7f9cf2d60","title":"ESXi Storage Information Discovery Via ESXCLI","author":"Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon","status":"test","level":"medium","date":"2023-09-04","modified":null,"description":"Detects execution of the \"esxcli\" command with the \"storage\" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.","references":["https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html","https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html","https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_storage.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.execution","attack.t1033","attack.t1007","attack.t1059.012"],"path":"rules/linux/process_creation/proc_creation_lnx_esxcli_storage_discovery.yml","techniques":["T1033","T1007","T1059.012"],"cves":[]},{"id":"fa3c117a-bc0d-416e-a31b-0c0e80653efb","title":"Chopper Webshell Process Pattern","author":"Florian Roth (Nextron Systems), MSTI (query)","status":"test","level":"high","date":"2022-10-01","modified":null,"description":"Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells","references":["https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.discovery","attack.t1505.003","attack.t1018","attack.t1033","attack.t1087"],"path":"rules/windows/process_creation/proc_creation_win_webshell_chopper.yml","techniques":["T1505.003","T1018","T1033","T1087"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2024-4577","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-22518","state":"mapped","mapping_types":["primary_impact"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}