T1033 Elastic Security · Elastic

Detect System Owner/User Discovery in Elastic Security

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this by retrieving account usernames via built-in OS utilities such as whoami, query user, qwinsta, w, who, and id, or by querying environment variables, WMI, and Active Directory. The information is used during automated discovery to shape follow-on behaviors — determining whether to fully deploy a payload, escalate privileges, or target a specific high-value user account.

MITRE ATT&CK

Tactic
Discovery
Technique
T1033 System Owner/User Discovery
Canonical reference
https://attack.mitre.org/techniques/T1033/

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.id with maxspan=5m
  [process where event.type == "start" and
    (
      (process.name : "whoami.exe" and process.args : ("/all", "/groups", "/priv", "/fo"))
      or process.name : ("query.exe", "qwinsta.exe", "quser.exe")
      or (process.name : "wmic.exe" and process.command_line : ("*useraccount*", "*UserAccount*"))
      or (process.name : "net.exe" and process.command_line : ("*user /domain*", "*localgroup administrators*", "*group /domain*"))
      or (process.name : "net1.exe" and process.command_line : ("*user /domain*", "*localgroup administrators*"))
      or (process.name : ("powershell.exe", "pwsh.exe") and process.command_line : ("*Get-LocalUser*", "*Get-ADUser*", "*Win32_UserAccount*", "*WindowsIdentity*", "*whoami*"))
    )
  ] by process.parent.entity_id
  [process where event.type == "start" and
    process.parent.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "schtasks.exe", "msbuild.exe", "installutil.exe")
  ] by process.entity_id

/* Standalone alert for single-event detection without parent correlation */
// process where event.type == "start" and
//   (
//     (process.name : "whoami.exe" and process.args : ("/all", "/groups", "/priv", "/fo"))
//     or process.name : ("query.exe", "qwinsta.exe", "quser.exe")
//     or (process.name : "wmic.exe" and process.command_line : ("*useraccount*", "*UserAccount*"))
//     or (process.name : "net.exe" and process.command_line : ("*user /domain*", "*localgroup administrators*", "*group /domain*"))
//     or (process.name : ("powershell.exe", "pwsh.exe") and process.command_line : ("*Get-LocalUser*", "*Get-ADUser*", "*Win32_UserAccount*", "*WindowsIdentity*", "*whoami*"))
//   ) and
//   process.parent.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
medium severity high confidence

Detects T1033 System Owner/User Discovery by correlating user enumeration commands (whoami /all, query user, qwinsta, wmic useraccount, net user /domain, Get-LocalUser, Get-ADUser) launched from suspicious parent processes. Uses EQL sequence to correlate discovery tool execution with suspicious initiating process context. Risk scoring applied via parent process and privilege context.

Data Sources

Elastic Endpoint SecurityWinlogbeat with SysmonElastic Agent (endpoint integration)

Required Tables

logs-endpoint.events.process-*logs-windows.sysmon_operational-*winlogbeat-*

False Positives & Tuning

  • IT administrators running whoami /all or net user /domain for legitimate identity verification or troubleshooting — especially during onboarding, patch validation, or Active Directory audits
  • Security tooling and EDR agents that periodically enumerate local users for inventory purposes may trigger on wmic useraccount or Get-LocalUser patterns
  • Remote Desktop and terminal server administration tools (e.g., Remote Desktop Services management scripts) that use qwinsta and quser for session monitoring in multi-user environments
Download portable Sigma rule (.yml)

Other platforms for T1033

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Whoami Full Enumeration

    Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\whoami.exe, CommandLine='whoami /all', ParentImage=cmd.exe or calling shell. Security Event ID 4688 if command line auditing is enabled. No network events expected.

  2. Test 2Query Active User Sessions

    Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\query.exe, CommandLine='query user'. Alternatively may appear as quser.exe. Security Event ID 4688 with command line auditing enabled.

  3. Test 3WMI User Account Enumeration

    Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\wbem\wmic.exe, CommandLine containing 'useraccount get'. No network events if targeting local system. Security Event ID 4688 with full command line if auditing is enabled.

  4. Test 4Linux Multi-Command User Discovery

    Expected signal: Linux auditd: SYSCALL records for execve of /usr/bin/whoami, /usr/bin/id, /usr/bin/w, /usr/bin/who, /usr/bin/last, /bin/cat with respective arguments. Syslog entries if auditd is configured to log to syslog. On systems with Sysmon for Linux: EventType=ProcessCreate for each command.

  5. Test 5PowerShell Active Directory User Enumeration

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-WmiObject' and 'Win32_UserAccount'. PowerShell ScriptBlock Logging Event ID 4104 in Microsoft-Windows-PowerShell/Operational log with full script content. No AD network queries for local account enumeration.

Last updated: 2026-04-16 Research depth: deep
References (10)

Unlock Pro Content

Get the full detection package for T1033 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Related Techniques

T1082System Information DiscoveryT1087.001Local AccountT1087.002Domain AccountT1069.001Local GroupsT1069.002Domain GroupsT1016System Network Configuration DiscoveryT1057Process DiscoveryT1049System Network Connections DiscoveryT1007System Service DiscoveryT1003OS Credential Dumping

Same Tactic: Discovery

Popular Detections