System Owner/User Discovery

let UserDiscoveryCommands = dynamic([
  "whoami", "query user", "qwinsta", "quser",
  "wmic useraccount", "wmic /node",
  "net user", "net localgroup",
  "Get-LocalUser", "Get-ADUser",
  "$env:USERNAME", "%USERNAME%", "%USERDOMAIN%"
]);
let SuspiciousParents = dynamic([
  "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe",
  "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe",
  "schtasks.exe", "at.exe", "msbuild.exe", "installutil.exe"
]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
    // whoami with enumeration flags is more suspicious than bare whoami
    (FileName =~ "whoami.exe" and ProcessCommandLine has_any ("/all", "/groups", "/priv", "/fo"))
    // query user / qwinsta used outside of RDS admin contexts
    or FileName in~ ("query.exe", "qwinsta.exe", "quser.exe")
    // wmic useraccount enumeration
    or (FileName =~ "wmic.exe" and ProcessCommandLine has_any ("useraccount", "UserAccount"))
    // net user domain enumeration
    or (FileName =~ "net.exe" and ProcessCommandLine has_any ("user /domain", "localgroup administrators", "group /domain"))
    or (FileName =~ "net1.exe" and ProcessCommandLine has_any ("user /domain", "localgroup administrators"))
    // PowerShell user enumeration cmdlets
    or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Get-LocalUser", "Get-ADUser", "Get-WmiObject Win32_UserAccount", "[System.Security.Principal.WindowsIdentity]::GetCurrent", "whoami"))
)
| extend SuspiciousParent = InitiatingProcessFileName in~ (SuspiciousParents)
| extend BareWhoami = (FileName =~ "whoami.exe" and not (ProcessCommandLine has_any ("/all", "/groups", "/priv", "/fo")))
| extend HighPrivContext = AccountName has_any ("SYSTEM", "Administrator") or InitiatingProcessAccountName has_any ("SYSTEM", "Administrator")
| extend RiskScore = toint(SuspiciousParent) + toint(not BareWhoami) + toint(HighPrivContext)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         InitiatingProcessAccountName, SuspiciousParent, HighPrivContext, RiskScore
| sort by Timestamp desc

index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1)
  (
    (Image="*\\whoami.exe" AND (CommandLine="*/all*" OR CommandLine="*/groups*" OR CommandLine="*/priv*" OR CommandLine="*/fo*"))
    OR (Image="*\\query.exe" OR Image="*\\qwinsta.exe" OR Image="*\\quser.exe")
    OR (Image="*\\wmic.exe" AND (CommandLine="*useraccount*" OR CommandLine="*UserAccount*"))
    OR (Image="*\\net.exe" AND (CommandLine="*user /domain*" OR CommandLine="*localgroup administrators*" OR CommandLine="*group /domain*"))
    OR (Image="*\\net1.exe" AND (CommandLine="*user /domain*" OR CommandLine="*localgroup administrators*"))
    OR ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND (CommandLine="*Get-LocalUser*" OR CommandLine="*Get-ADUser*" OR CommandLine="*Win32_UserAccount*" OR CommandLine="*WindowsIdentity*" OR CommandLine="*whoami*"))
  )
| eval SuspiciousParent=if(match(ParentImage, "(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|schtasks\.exe|msbuild\.exe|installutil\.exe)$"), 1, 0)
| eval EnrichedFlags=if(match(lower(CommandLine), "(/all|/groups|/priv|/fo|useraccount|get-localuser|get-aduser|windowsidentity)"), 1, 0)
| eval HighPriv=if(match(lower(User), "(system|administrator|admin)"), 1, 0)
| eval RiskScore=SuspiciousParent + EnrichedFlags + HighPriv
| where RiskScore >= 1
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, SuspiciousParent, EnrichedFlags, HighPriv, RiskScore
| sort - RiskScore, - _time

sequence by host.id with maxspan=5m
  [process where event.type == "start" and
    (
      (process.name : "whoami.exe" and process.args : ("/all", "/groups", "/priv", "/fo"))
      or process.name : ("query.exe", "qwinsta.exe", "quser.exe")
      or (process.name : "wmic.exe" and process.command_line : ("*useraccount*", "*UserAccount*"))
      or (process.name : "net.exe" and process.command_line : ("*user /domain*", "*localgroup administrators*", "*group /domain*"))
      or (process.name : "net1.exe" and process.command_line : ("*user /domain*", "*localgroup administrators*"))
      or (process.name : ("powershell.exe", "pwsh.exe") and process.command_line : ("*Get-LocalUser*", "*Get-ADUser*", "*Win32_UserAccount*", "*WindowsIdentity*", "*whoami*"))
    )
  ] by process.parent.entity_id
  [process where event.type == "start" and
    process.parent.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "schtasks.exe", "msbuild.exe", "installutil.exe")
  ] by process.entity_id

/* Standalone alert for single-event detection without parent correlation */
// process where event.type == "start" and
//   (
//     (process.name : "whoami.exe" and process.args : ("/all", "/groups", "/priv", "/fo"))
//     or process.name : ("query.exe", "qwinsta.exe", "quser.exe")
//     or (process.name : "wmic.exe" and process.command_line : ("*useraccount*", "*UserAccount*"))
//     or (process.name : "net.exe" and process.command_line : ("*user /domain*", "*localgroup administrators*", "*group /domain*"))
//     or (process.name : ("powershell.exe", "pwsh.exe") and process.command_line : ("*Get-LocalUser*", "*Get-ADUser*", "*Win32_UserAccount*", "*WindowsIdentity*", "*whoami*"))
//   ) and
//   process.parent.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  LOGSOURCENAME(logsourceid) AS log_source,
  username,
  "Account Domain" AS account_domain,
  "Process Name" AS process_name,
  "Process Command Line" AS command_line,
  "Parent Process Name" AS parent_process,
  CASE
    WHEN LOWER("Parent Process Name") MATCHES '(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|schtasks\.exe|msbuild\.exe|installutil\.exe)$' THEN 1
    ELSE 0
  END AS suspicious_parent,
  CASE
    WHEN LOWER("Process Command Line") IMATCHES '.*((/all|/groups|/priv|/fo)|useraccount|get-localuser|get-aduser|windowsidentity|user /domain|localgroup administrators).*' THEN 1
    ELSE 0
  END AS enriched_flags,
  CASE
    WHEN LOWER(username) IMATCHES '.*(system|administrator|admin).*' THEN 1
    ELSE 0
  END AS high_priv
FROM events
WHERE
  LOGSOURCETYPEID IN (12, 14, 169, 260)
  AND QIDNAME(qid) IN ('Process Create', 'Sysmon - Process Create')
  AND (
    (LOWER("Process Name") IMATCHES '.*\\whoami\.exe$' AND LOWER("Process Command Line") IMATCHES '.*/all.*|.*/groups.*|.*/priv.*|.*/fo.*')
    OR LOWER("Process Name") IMATCHES '.*(\\query\.exe|\\qwinsta\.exe|\\quser\.exe)$'
    OR (LOWER("Process Name") IMATCHES '.*\\wmic\.exe$' AND LOWER("Process Command Line") IMATCHES '.*(useraccount|useraccount).*')
    OR (LOWER("Process Name") IMATCHES '.*\\net\.exe$' AND LOWER("Process Command Line") IMATCHES '.*(user /domain|localgroup administrators|group /domain).*')
    OR (LOWER("Process Name") IMATCHES '.*\\net1\.exe$' AND LOWER("Process Command Line") IMATCHES '.*(user /domain|localgroup administrators).*')
    OR (LOWER("Process Name") IMATCHES '.*(\\powershell\.exe|\\pwsh\.exe)$' AND LOWER("Process Command Line") IMATCHES '.*(get-localuser|get-aduser|win32_useraccount|windowsidentity|whoami).*')
  )
  AND LAST 24 HOURS
ORDER BY
  (suspicious_parent + enriched_flags + high_priv) DESC, starttime DESC

(_sourceCategory="windows/sysmon" OR _sourceCategory="windows/security" OR _sourceCategory="os/windows")
| where EventID = "1" or EventID = "4688"
| where (
    (toLowerCase(Image) matches "*\\whoami.exe" and (toLowerCase(CommandLine) matches "*/all*" or toLowerCase(CommandLine) matches "*/groups*" or toLowerCase(CommandLine) matches "*/priv*" or toLowerCase(CommandLine) matches "*/fo*"))
    or toLowerCase(Image) matches "*\\query.exe" or toLowerCase(Image) matches "*\\qwinsta.exe" or toLowerCase(Image) matches "*\\quser.exe"
    or (toLowerCase(Image) matches "*\\wmic.exe" and (toLowerCase(CommandLine) matches "*useraccount*"))
    or (toLowerCase(Image) matches "*\\net.exe" and (toLowerCase(CommandLine) matches "*user /domain*" or toLowerCase(CommandLine) matches "*localgroup administrators*" or toLowerCase(CommandLine) matches "*group /domain*"))
    or (toLowerCase(Image) matches "*\\net1.exe" and (toLowerCase(CommandLine) matches "*user /domain*" or toLowerCase(CommandLine) matches "*localgroup administrators*"))
    or ((toLowerCase(Image) matches "*\\powershell.exe" or toLowerCase(Image) matches "*\\pwsh.exe") and (toLowerCase(CommandLine) matches "*get-localuser*" or toLowerCase(CommandLine) matches "*get-aduser*" or toLowerCase(CommandLine) matches "*win32_useraccount*" or toLowerCase(CommandLine) matches "*windowsidentity*" or toLowerCase(CommandLine) matches "*whoami*"))
  )
| if(toLowerCase(ParentImage) matches "*(cmd.exe|powershell.exe|pwsh.exe|wscript.exe|cscript.exe|mshta.exe|rundll32.exe|regsvr32.exe|schtasks.exe|msbuild.exe|installutil.exe)", 1, 0) as suspicious_parent
| if(toLowerCase(CommandLine) matches "*(/all|/groups|/priv|/fo|useraccount|get-localuser|get-aduser|windowsidentity|user /domain|localgroup administrators)*", 1, 0) as enriched_flags
| if(toLowerCase(User) matches "*(system|administrator|admin)*", 1, 0) as high_priv
| suspicious_parent + enriched_flags + high_priv as RiskScore
| where RiskScore >= 1
| fields _messageTime, Computer, User, Image, CommandLine, ParentImage, ParentCommandLine, suspicious_parent, enriched_flags, high_priv, RiskScore
| sort by RiskScore desc, _messageTime desc

rule T1033_System_Owner_User_Discovery {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1033 System Owner/User Discovery via execution of user enumeration utilities with suspicious parent process or elevated privilege context"
    mitre_attack_tactic = "Discovery"
    mitre_attack_technique = "T1033"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1033/"
    severity = "MEDIUM"
    confidence = "HIGH"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      (
        re.regex($e.target.process.file.full_path, `(?i).*\\whoami\.exe$`) and
        re.regex($e.target.process.command_line, `(?i).*(/all|/groups|/priv|/fo).*`)
      ) or
      re.regex($e.target.process.file.full_path, `(?i).*\\(query|qwinsta|quser)\.exe$`) or
      (
        re.regex($e.target.process.file.full_path, `(?i).*\\wmic\.exe$`) and
        re.regex($e.target.process.command_line, `(?i).*(useraccount).*`)
      ) or
      (
        re.regex($e.target.process.file.full_path, `(?i).*\\net1?\.exe$`) and
        re.regex($e.target.process.command_line, `(?i).*(user\s+/domain|localgroup\s+administrators|group\s+/domain).*`)
      ) or
      (
        re.regex($e.target.process.file.full_path, `(?i).*\\(powershell|pwsh)\.exe$`) and
        re.regex($e.target.process.command_line, `(?i).*(Get-LocalUser|Get-ADUser|Win32_UserAccount|WindowsIdentity|whoami).*`)
      )
    )
    (
      re.regex($e.principal.process.file.full_path, `(?i).*\\(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|schtasks|msbuild|installutil)\.exe$`) or
      re.regex($e.principal.user.userid, `(?i).*(system|administrator|admin).*`) or
      re.regex($e.target.process.command_line, `(?i).*(/all|/groups|/priv|/fo|useraccount|Get-LocalUser|Get-ADUser|WindowsIdentity|user\s*/domain|localgroup administrators).*`)
    )

  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ImageFileName = /(?i)(\\whoami\.exe|\\query\.exe|\\qwinsta\.exe|\\quser\.exe|\\wmic\.exe|\\net\.exe|\\net1\.exe|\\powershell\.exe|\\pwsh\.exe)$/
| CommandLine = /(?i)(/all|/groups|/priv|/fo|useraccount|UserAccount|user\s+/domain|localgroup\s+administrators|group\s+/domain|Get-LocalUser|Get-ADUser|Win32_UserAccount|WindowsIdentity|whoami)/
| ParentBaseFileName = /(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|schtasks\.exe|msbuild\.exe|installutil\.exe)/
  OR UserName = /(?i)(SYSTEM|Administrator)/
| SuspiciousParent := if(ParentBaseFileName = /(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|schtasks\.exe|msbuild\.exe|installutil\.exe)/, 1, 0)
| EnrichedFlags := if(CommandLine = /(?i)(/all|/groups|/priv|/fo|useraccount|Get-LocalUser|Get-ADUser|WindowsIdentity|user\s*/domain|localgroup administrators)/, 1, 0)
| HighPriv := if(UserName = /(?i)(SYSTEM|Administrator|admin)/, 1, 0)
| RiskScore := SuspiciousParent + EnrichedFlags + HighPriv
| RiskScore >= 1
| groupBy([ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName], function=[
    count(as=EventCount),
    max(RiskScore, as=MaxRiskScore),
    min(@timestamp, as=FirstSeen),
    max(@timestamp, as=LastSeen)
  ])
| sort(MaxRiskScore, order=desc)