t1033-system-owneruser-discovery

name	T1033_system-owneruser-discovery
description	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system.
category	information-gathering
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1033","discovery","linux","macos","network-devices","windows"]
technique_id	T1033
tactic	discovery
all_tactics	["discovery"]
platforms	["Linux","macOS","Network Devices","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1033
tech_stack	["linux","macos","network devices","windows"]
cwe_ids	["CWE-200"]
chains_with	[]
prerequisites	[]
severity_boost	{}

T1033 System Owner/User Discovery

High-Level Description

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping. The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Various utilities and commands may acquire this information, including whoami. In macOS and Linux, the currently logged in user can be identified with w and who. On macOS the dscl . list /Users | grep -v '_' command can also be used to enumerate user accounts. Environment variables, such as %USERNAME% and $USER, may also be used to access this information.

On network devices, Network Device CLI commands such as show users and show ssh can be used to display users currently logged into the device.

Kill Chain Phase

• Discovery (TA0007)

Platforms: Linux, macOS, Network Devices, Windows

What to Check

• Identify if System Owner/User Discovery technique is applicable to target environment
• Check Linux systems for indicators of System Owner/User Discovery
• Check macOS systems for indicators of System Owner/User Discovery
• Check Network Devices systems for indicators of System Owner/User Discovery
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: System Owner/User Discovery

Identify System owner or users on an endpoint.

Upon successful execution, cmd.exe will spawn multiple commands against a target host to identify usernames. Output will be via stdout. Additionally, two files will be written to disk - computers.txt and usernames.txt.