T1033 System Owner/User Discovery
Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). The information may be collected in a number of different ways using other Discovery…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- Potential Dridex Activitycriticalstable · windows
- Renamed Whoami Executioncriticaltest · windows
- Chopper Webshell Process Patternhightest · windows
- HackTool - SharpLdapWhoami Executionhightest · windows
- HackTool - SharpView Executionhightest · windows
- Possible DCSync Attackhightest · rpc_firewall
- Security Privileges Enumeration Via Whoami.EXEhightest · windows
- SharpHound Recon Sessionshightest · rpc_firewall
- Webshell Detection With Command Line Keywordshightest · windows
- Webshell Hacking Activity Patternshightest · windows
- WhoAmI as Parameterhightest · windows
- Whoami.EXE Execution From Privileged Processhightest · windows
- Computer Discovery And Export Via Get-ADComputer Cmdletmediumtest · windows
- Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShellmediumtest · windows
- ESXi Network Configuration Discovery Via ESXCLImediumtest · linux
- ESXi Storage Information Discovery Via ESXCLImediumtest · linux
- ESXi System Information Discovery Via ESXCLImediumtest · linux
- ESXi VM List Discovery Via ESXCLImediumtest · linux
- ESXi VSAN Information Discovery Via ESXCLImediumtest · linux
- Enumerate All Information With Whoami.EXEmediumtest · windows
- Get-ADUser Enumeration Using UserAccountControl Flagsmediumtest · windows
- Group Membership Reconnaissance Via Whoami.EXEmediumtest · windows
- User Discovery And Export Via Get-ADUser Cmdletmediumtest · windows
- User Discovery And Export Via Get-ADUser Cmdlet - PowerShellmediumtest · windows
- Whoami.EXE Execution Anomalymediumtest · windows
Mostrando 25 de 26.
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.