MITRE ATT&CKtechnique

T1033 System Owner/User Discovery

Published 2017-05-31 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Discovery
Platforms
Linux, macOS, Network Devices, Windows
Version
1.6
Created
2017-05-31

Description

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping. The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Various utilities and commands may acquire this information, including whoami. In macOS and Linux, the currently logged in user can be identified with w and who. On macOS the dscl . list /Users | grep -v '_' command can also be used to enumerate user accounts. Environment variables, such as %USERNAME% and $USER, may also be used to access this information. On network devices, Network Device CLI commands such as `show users` and `show ssh` can be used to display users currently logged into the device.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (251)

  • S9062 MiniBrowse software (malware)
  • S9063 DEEPROOT software (malware)
  • S9067 TWOSTROKE software (malware)
  • S9052 MiniFast software (malware)
  • S9053 MiniJunk software (malware)
  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • S9046 IOControl software (malware)
  • S9043 Mini Shai-Hulud software (malware)
  • S9042 CanisterWorm software (malware)
  • S9041 TeamPCP Cloud Stealer software (malware)
  • S9035 LAMEHUG software (malware)
  • S9037 RustyWater software (malware)
  • S9029 IronWind software (malware)
  • C0061 Operation Digital Eye campaign
  • G1054 MirrorFace group
  • S9020 LODEINFO software (malware)
  • S9023 HiddenFace software (malware)
  • S9019 PureCrypter software (malware)
  • S1248 XORIndex Loader software (malware)
  • S1249 HexEval Loader software (malware)
  • S1245 InvisibleFerret software (malware)
  • C0058 SharePoint ToolShell Exploitation campaign
  • G1051 Medusa Group group
  • S1240 RedLine Stealer software (malware)
  • S1239 TONESHELL software (malware)
  • S1229 Havoc software (malware)
  • S1228 PUBLOAD software (malware)
  • S1226 BOOKWORM software (malware)
  • G1046 Storm-1811 group
  • S1207 XLoader software (malware)
Show all 251 ›

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-577 Owner Footprinting attack pattern

References