attack.t1033

HackTool - SharpLdapWhoami Execution

Dec 1, 2023 · attack.discovery attack.t1033 car.2016-03-001 ·

Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller

Suspicious Whoami.EXE Execution

Nov 10, 2023 · attack.discovery attack.t1033 car.2016-03-001 ·

Detects the execution of "whoami.exe" with the "/all" flag or with redirection options to export the results to a file for later use.

Chopper Webshell Process Pattern

Nov 10, 2023 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·

Share on:

Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells

Webshell Detection With Command Line Keywords

Nov 10, 2023 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·

Share on:

Detects certain command line parameters often used during reconnaissance activity via web shells

Webshell Hacking Activity Patterns

Nov 10, 2023 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·

Share on:

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

Computer Discovery And Export Via Get-ADComputer Cmdlet

Oct 18, 2023 · attack.discovery attack.t1033 ·

Share on:

Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file

Get-ADUser Enumeration Using UserAccountControl Flags

Oct 18, 2023 · attack.discovery attack.t1033 ·

Share on:

Detects AS-REP roasting is an attack that is often-overlooked. It is not very common as you have to explicitly set accounts that do not require pre-authentication.

HackTool - SharpView Execution

Oct 18, 2023 · attack.discovery attack.t1049 attack.t1069.002 attack.t1482 attack.t1135 attack.t1033 ·

Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

User Discovery And Export Via Get-ADUser Cmdlet

Oct 18, 2023 · attack.discovery attack.t1033 ·

Share on:

Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file

Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell

Oct 17, 2023 · attack.discovery attack.t1033 ·

Share on:

Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file

Suspicious PowerShell Get Current User

Oct 17, 2023 · attack.discovery attack.t1033 ·

Share on:

Detects the use of PowerShell to identify the current logged user.

User Discovery And Export Via Get-ADUser Cmdlet - PowerShell

Oct 17, 2023 · attack.discovery attack.t1033 ·

Share on:

Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file

ESXi Network Configuration Discovery Via ESXCLI

Sep 6, 2023 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.

ESXi Storage Information Discovery Via ESXCLI

Sep 6, 2023 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.

ESXi System Information Discovery Via ESXCLI

Sep 6, 2023 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.

ESXi VM List Discovery Via ESXCLI

Sep 6, 2023 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.

ESXi VSAN Information Discovery Via ESXCLI

Sep 6, 2023 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.

Possible DCSync Attack

Jun 22, 2023 · attack.t1033 attack.discovery ·

Share on:

Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.

SharpHound Recon Sessions

Jun 22, 2023 · attack.t1033 ·

Share on:

Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.

Potential Dridex Activity

Jun 20, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 attack.discovery attack.t1135 attack.t1033 detection.emerging_threats ·

Share on:

Detects potential Dridex acitvity via specific process patterns

SocGholish Script File Whoami Output to File (RedCanary Threat Detection Report)

May 10, 2023 · attack.discovery attack.t1033 ·

Share on:

Detects wscript spawning CMD which in turn runs whoami, with the output of the command directed to a file. Part of the RedCanary 2023 Threat Detection Report.

WinEvent Security Query

Apr 2, 2023 · attack.t1033 ·

Share on:

Detects querying of Windows Security log for account activity

Group Membership Reconnaissance Via Whoami.EXE

Feb 28, 2023 · attack.discovery attack.t1033 ·

Share on:

Detects the execution of whoami.exe with the /group command line flag to show group membership for the current user, account type, security identifiers (SID), and attributes.

Security Privileges Enumeration Via Whoami.EXE

Feb 28, 2023 · attack.privilege_escalation attack.discovery attack.t1033 ·

Share on:

Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privileges. This is often used after a privilege escalation attempt.

Suspicious Whoami.EXE Execution From Privileged Process

Feb 28, 2023 · attack.privilege_escalation attack.discovery attack.t1033 ·

Share on:

Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors

Whoami Utility Execution

Feb 28, 2023 · attack.discovery attack.t1033 car.2016-03-001 ·

Share on:

Detects the execution of whoami, which is often used by attackers after exploitation / privilege escalation

Whoami.EXE Execution Anomaly

Feb 28, 2023 · attack.discovery attack.t1033 car.2016-03-001 ·

Share on:

Detects the execution of whoami.exe with suspicious parent processes.

Local Accounts Discovery

Feb 21, 2023 · attack.discovery attack.t1033 attack.t1087.001 ·

Share on:

Local accounts, System Owner/User discovery using operating systems utilities

Renamed Whoami Execution

Feb 1, 2023 · attack.discovery attack.t1033 car.2016-03-001 ·

Share on:

Detects the execution of whoami that has been renamed to a different name to avoid detection

WhoAmI as Parameter

Feb 1, 2023 · attack.discovery attack.t1033 car.2016-03-001 ·

Share on:

Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)

Cisco Discovery

Jan 4, 2023 · attack.discovery attack.t1083 attack.t1201 attack.t1057 attack.t1018 attack.t1082 attack.t1016 attack.t1049 attack.t1033 attack.t1124 ·

Share on:

Find information about network devices that is not stored in config files

System Owner or User Discovery

Oct 25, 2022 · attack.discovery attack.t1033 ·

Share on:

Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.