Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1033

System Owner/User Discovery

Discovery 64 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic Suspicious React Server Child Process production 2026-10-09
elastic Whoami Process Activity production 2026-10-09
elastic Privilege Boundary Enumeration Detected via Defend for Containers production 2026-10-08
splunk User Discovery With Env Vars PowerShell production 2026-10-02
splunk System User Discovery With Query production 2026-10-02
splunk Linux Auditd Whoami User Discovery production 2026-10-02
splunk GetCurrent User with PowerShell Script Block production 2026-10-02
splunk GetCurrent User with PowerShell production 2026-10-02
splunk User Discovery With Env Vars PowerShell Script Block production 2026-10-02
splunk Windows System User Discovery Via Quser production 2026-10-02
elastic Unusual User Privilege Enumeration via id production 2026-09-18
elastic Sudo Command Enumeration Detected production 2026-09-18
elastic AWS STS GetCallerIdentity API Called for the First Time production 2026-09-18
elastic Suspicious MS Office Child Process production 2026-09-18
elastic Suspicious JetBrains TeamCity Child Process production 2026-09-18
elastic Suspicious PDF Reader Child Process production 2026-09-18
elastic Enumeration Command Spawned via WMIPrvSE production 2026-09-18
elastic PowerShell Suspicious Discovery Related Windows API Functions production 2026-09-18
elastic Account Discovery Command via SYSTEM Account production 2026-09-18
elastic Unusual Linux User Discovery Activity production 2026-09-18
elastic Discovery Command Output Written to Suspicious File production 2026-09-18
elastic Suspicious System Commands Executed by Previously Unknown Executable production 2026-09-18
elastic Passwordless Sudo Probing production 2026-09-18
elastic Potentially Suspicious Process Started via tmux or screen production 2026-09-18
splunk System User Discovery With Whoami production 2026-08-30
sigma Webshell Detection With Command Line Keywords test 2026-07-14
splunk Linux Root Execution of id production 2026-07-08
splunk Windows System User Privilege Discovery production 2026-05-13
splunk Windows WinPEAS PowerShell Script Execution production 2026-05-13
splunk Windows Common Abused Cmd Shell Risk Behavior production 2026-05-13
splunk Windows System Discovery Using ldap Nslookup production 2026-05-13
splunk Windows System Discovery Using Qwinsta production 2026-05-13
splunk Windows System Remote Discovery With Query production 2026-05-13
splunk Check Elevated CMD using whoami production 2026-05-13
sigma Local Accounts Discovery test 2025-10-20
sigma System Owner or User Discovery - Linux test 2025-06-04
sigma Whoami.EXE Execution Anomaly test 2025-03-06
sigma Enumerate All Information With Whoami.EXE test 2024-03-05
sigma Whoami.EXE Execution From Privileged Process test 2023-12-04
sigma Whoami.EXE Execution With Output Option test 2023-12-04
sigma Webshell Hacking Activity Patterns test 2023-11-09
sigma ESXi VM List Discovery Via ESXCLI test 2023-09-04
sigma ESXi Network Configuration Discovery Via ESXCLI test 2023-09-04
sigma ESXi Storage Information Discovery Via ESXCLI test 2023-09-04
sigma ESXi System Information Discovery Via ESXCLI test 2023-09-04
sigma ESXi VSAN Information Discovery Via ESXCLI test 2023-09-04
sigma Group Membership Reconnaissance Via Whoami.EXE test 2023-02-28
sigma Security Privileges Enumeration Via Whoami.EXE test 2023-02-28
sigma HackTool - SharpView Execution test 2023-02-14
sigma HackTool - SharpLdapWhoami Execution test 2023-02-04
sigma Potential Dridex Activity stable 2023-02-03
sigma Cisco Discovery test 2023-01-04
sigma WhoAmI as Parameter test 2022-12-25
sigma Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell test 2022-11-17
sigma User Discovery And Export Via Get-ADUser Cmdlet - PowerShell test 2022-11-17
sigma Computer Discovery And Export Via Get-ADComputer Cmdlet test 2022-11-17
sigma User Discovery And Export Via Get-ADUser Cmdlet test 2022-11-17
sigma Renamed Whoami Execution test 2022-10-09
sigma Chopper Webshell Process Pattern test 2022-10-01
sigma Suspicious PowerShell Get Current User test 2022-04-04
sigma Get-ADUser Enumeration Using UserAccountControl Flags test 2022-03-17
sigma Possible DCSync Attack test 2022-01-01
sigma SharpHound Recon Sessions test 2022-01-01
elastic User Discovery via Whoami deprecated 2021-04-15