T1033 — System Owner/User Discovery

Tactic: Discovery · Platforms: Linux, macOS, Network Devices, Windows

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping. The information may be…

Sigma detection rules (4)

T1033 System Owner/User Discovery

title: T1033 System Owner/User Discovery
id: e9b254cf-b36d-4161-8642-266d6640b8f9
description: 'Behavioral Detection of User Discovery via Local and Remote Enumeration. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: ParentProcessContext, TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1033
author: Shahrukh Khan
date: 2026-01-23
license: MIT
tags:
  - attack.discovery
  - attack.t1033

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith:
      - '\whoami.exe'
      - '\query.exe'
    CommandLine|contains: 'user'

  condition: selection

falsepositives:
  - Extremely common benign discovery activity by both users and legitimate scripts.

level: informational

T1033 System Owner/User Discovery

title: T1033 System Owner/User Discovery
id: 7aaaf505-5264-4ace-89ce-7edac9ad3732
description: 'Behavioral Detection of User Discovery via Local and Remote Enumeration. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CommandLineRegex, ShellContext, AccessFrequency.'
references:
  - https://attack.mitre.org/techniques/T1033
author: Shahrukh Khan
date: 2026-04-30
license: MIT
tags:
  - attack.discovery
  - attack.t1033

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/whoami'
      - '/id'
      - '/who'
      - '/w'
      - '/last'
  condition: selection

falsepositives:
  - Routine and extremely common commands used by both administrators and normal shell sessions.

level: informational

T1033 System Owner/User Discovery

title: T1033 System Owner/User Discovery
id: e520521c-defb-4ed9-a8ce-690311177ff2
description: 'Behavioral Detection of User Discovery via Local and Remote Enumeration. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: LaunchAgentPersistence, CommandExecutionPath, UsernameEnumerationPattern.'
references:
  - https://attack.mitre.org/techniques/T1033
author: Shahrukh Khan
date: 2026-02-06
license: MIT
tags:
  - attack.discovery
  - attack.t1033

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/whoami'
      - '/id'
      - '/w'
      - '/who'
  selection_dscl:
    Image|endswith: '/dscl'
    CommandLine|contains: '/Users'
  condition: 1 of selection*

falsepositives:
  - Routine shell prompt customization scripts or login banners that call whoami or id on session start.

level: informational

T1033 System Owner/User Discovery

title: T1033 System Owner/User Discovery
id: b5e941ab-7819-4f33-85e5-c927d6e072f0
description: 'Behavioral Detection of User Discovery via Local and Remote Enumeration. (Data Component: OS API Execution; baseline tier: fallback.) Tune using: CLICommandBaseline, DeviceRoleSensitivity, CommandFrequencyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1033
author: Shahrukh Khan
date: 2026-01-23
license: MIT
tags:
  - attack.discovery
  - attack.t1033

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/whoami'
      - '/id'
      - '/who'
      - '/w'
      - '/logname'

  condition: selection

falsepositives:
  - Owner and user identity commands are used constantly in interactive shells, login banners, and scripts for entirely benign reasons.

level: informational

Explore