attack.t1033

Whoami.EXE Execution Anomaly

Oct 1, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·

Share on:

Detects the execution of whoami.exe with suspicious parent processes.

Whoami.EXE Execution From Privileged Process

Oct 1, 2024 · attack.privilege-escalation attack.discovery attack.t1033 ·

Share on:

Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors

Whoami.EXE Execution With Output Option

Oct 1, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·

Share on:

Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to export the results to a file for later use.

Chopper Webshell Process Pattern

Aug 12, 2024 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·

Share on:

Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells

Cisco Discovery

Aug 12, 2024 · attack.discovery attack.t1083 attack.t1201 attack.t1057 attack.t1018 attack.t1082 attack.t1016 attack.t1049 attack.t1033 attack.t1124 ·

Share on:

Find information about network devices that is not stored in config files

Computer Discovery And Export Via Get-ADComputer Cmdlet

Aug 12, 2024 · attack.discovery attack.t1033 ·

Share on:

Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file

Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell

Aug 12, 2024 · attack.discovery attack.t1033 ·

Share on:

Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file

Enumerate All Information With Whoami.EXE

Aug 12, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·

Share on:

Detects the execution of "whoami.exe" with the "/all" flag

ESXi Network Configuration Discovery Via ESXCLI

Aug 12, 2024 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.

ESXi Storage Information Discovery Via ESXCLI

Aug 12, 2024 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.

ESXi System Information Discovery Via ESXCLI

Aug 12, 2024 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.

ESXi VM List Discovery Via ESXCLI

Aug 12, 2024 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.

ESXi VSAN Information Discovery Via ESXCLI

Aug 12, 2024 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.

Get-ADUser Enumeration Using UserAccountControl Flags

Aug 12, 2024 · attack.discovery attack.t1033 ·

Share on:

Detects AS-REP roasting is an attack that is often-overlooked. It is not very common as you have to explicitly set accounts that do not require pre-authentication.

Group Membership Reconnaissance Via Whoami.EXE

Aug 12, 2024 · attack.discovery attack.t1033 ·

Share on:

Detects the execution of whoami.exe with the /group command line flag to show group membership for the current user, account type, security identifiers (SID), and attributes.

HackTool - SharpLdapWhoami Execution

Aug 12, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·

Share on:

Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller

HackTool - SharpView Execution

Aug 12, 2024 · attack.discovery attack.t1049 attack.t1069.002 attack.t1482 attack.t1135 attack.t1033 ·

Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Local Accounts Discovery

Aug 12, 2024 · attack.discovery attack.t1033 attack.t1087.001 ·

Share on:

Local accounts, System Owner/User discovery using operating systems utilities

Possible DCSync Attack

Aug 12, 2024 · attack.t1033 attack.discovery ·

Share on:

Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.

Potential Dridex Activity

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 attack.discovery attack.t1135 attack.t1033 detection.emerging-threats ·

Share on:

Detects potential Dridex acitvity via specific process patterns

Renamed Whoami Execution

Aug 12, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·

Share on:

Detects the execution of whoami that has been renamed to a different name to avoid detection

Security Privileges Enumeration Via Whoami.EXE

Aug 12, 2024 · attack.privilege-escalation attack.discovery attack.t1033 ·

Share on:

Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privileges. This is often used after a privilege escalation attempt.

SharpHound Recon Sessions

Aug 12, 2024 · attack.t1033 ·

Share on:

Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.

Suspicious PowerShell Get Current User

Aug 12, 2024 · attack.discovery attack.t1033 ·

Share on:

Detects the use of PowerShell to identify the current logged user.

System Owner or User Discovery

Aug 12, 2024 · attack.discovery attack.t1033 ·

Share on:

Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

User Discovery And Export Via Get-ADUser Cmdlet

Aug 12, 2024 · attack.discovery attack.t1033 ·

Share on:

Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file

User Discovery And Export Via Get-ADUser Cmdlet - PowerShell

Aug 12, 2024 · attack.discovery attack.t1033 ·

Share on:

Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file

Webshell Detection With Command Line Keywords

Aug 12, 2024 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·

Share on:

Detects certain command line parameters often used during reconnaissance activity via web shells

Webshell Hacking Activity Patterns

Aug 12, 2024 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·

Share on:

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

WhoAmI as Parameter

Aug 12, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·

Share on:

Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)

Whoami Utility Execution

Aug 12, 2024 · attack.discovery attack.t1033 car.2016-03-001 ·

Share on:

Detects the execution of whoami, which is often used by attackers after exploitation / privilege escalation

Whoami Recon Writing Output to File

Mar 26, 2024 · attack.discovery attack.t1033 ·

Share on:

SocGholish employs several scripted reconnaissance commands. While much of this activity occurs in memory, one that stands out is the execution of whoami with the output redirected to a local temp file with the naming convention rad<5-hex-chars>.tmp. Part of the RedCanary 2024 Threat Detection Report.

WinEvent Security Query

Feb 23, 2024 · attack.t1033 ·

Share on:

Detects querying of Windows Security log for account activity

SocGholish Script File Whoami Output to File (RedCanary Threat Detection Report)

May 10, 2023 · attack.discovery attack.t1033 ·

Share on:

Detects wscript spawning CMD which in turn runs whoami, with the output of the command directed to a file. Part of the RedCanary 2023 Threat Detection Report.