Detect System Owner/User Discovery in IBM QRadar
Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this by retrieving account usernames via built-in OS utilities such as whoami, query user, qwinsta, w, who, and id, or by querying environment variables, WMI, and Active Directory. The information is used during automated discovery to shape follow-on behaviors — determining whether to fully deploy a payload, escalate privileges, or target a specific high-value user account.
MITRE ATT&CK
- Tactic
- Discovery
- Technique
- T1033 System Owner/User Discovery
- Canonical reference
- https://attack.mitre.org/techniques/T1033/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
LOGSOURCENAME(logsourceid) AS log_source,
username,
"Account Domain" AS account_domain,
"Process Name" AS process_name,
"Process Command Line" AS command_line,
"Parent Process Name" AS parent_process,
CASE
WHEN LOWER("Parent Process Name") MATCHES '(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|schtasks\.exe|msbuild\.exe|installutil\.exe)$' THEN 1
ELSE 0
END AS suspicious_parent,
CASE
WHEN LOWER("Process Command Line") IMATCHES '.*((/all|/groups|/priv|/fo)|useraccount|get-localuser|get-aduser|windowsidentity|user /domain|localgroup administrators).*' THEN 1
ELSE 0
END AS enriched_flags,
CASE
WHEN LOWER(username) IMATCHES '.*(system|administrator|admin).*' THEN 1
ELSE 0
END AS high_priv
FROM events
WHERE
LOGSOURCETYPEID IN (12, 14, 169, 260)
AND QIDNAME(qid) IN ('Process Create', 'Sysmon - Process Create')
AND (
(LOWER("Process Name") IMATCHES '.*\\whoami\.exe$' AND LOWER("Process Command Line") IMATCHES '.*/all.*|.*/groups.*|.*/priv.*|.*/fo.*')
OR LOWER("Process Name") IMATCHES '.*(\\query\.exe|\\qwinsta\.exe|\\quser\.exe)$'
OR (LOWER("Process Name") IMATCHES '.*\\wmic\.exe$' AND LOWER("Process Command Line") IMATCHES '.*(useraccount|useraccount).*')
OR (LOWER("Process Name") IMATCHES '.*\\net\.exe$' AND LOWER("Process Command Line") IMATCHES '.*(user /domain|localgroup administrators|group /domain).*')
OR (LOWER("Process Name") IMATCHES '.*\\net1\.exe$' AND LOWER("Process Command Line") IMATCHES '.*(user /domain|localgroup administrators).*')
OR (LOWER("Process Name") IMATCHES '.*(\\powershell\.exe|\\pwsh\.exe)$' AND LOWER("Process Command Line") IMATCHES '.*(get-localuser|get-aduser|win32_useraccount|windowsidentity|whoami).*')
)
AND LAST 24 HOURS
ORDER BY
(suspicious_parent + enriched_flags + high_priv) DESC, starttime DESCDetects T1033 System Owner/User Discovery in QRadar using AQL against Windows Security event log and Sysmon process creation events. Queries for execution of whoami with enumeration flags, query/qwinsta/quser, wmic useraccount, net user /domain, and PowerShell user discovery cmdlets. Applies risk scoring based on suspicious parent process, enriched command-line flags, and high-privilege user context.
Data Sources
Required Tables
False Positives & Tuning
- Helpdesk or IT support staff using net user /domain or query user interactively from cmd.exe to troubleshoot user account or RDS session issues
- System inventory or SCCM/Intune management agents that use wmic useraccount or PowerShell Get-LocalUser for compliance reporting and asset management
- Automated deployment scripts and CI/CD pipelines that verify user context with whoami or environment variable checks before executing privileged operations
Other platforms for T1033
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Whoami Full Enumeration
Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\whoami.exe, CommandLine='whoami /all', ParentImage=cmd.exe or calling shell. Security Event ID 4688 if command line auditing is enabled. No network events expected.
- Test 2 Query Active User Sessions
Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\query.exe, CommandLine='query user'. Alternatively may appear as quser.exe. Security Event ID 4688 with command line auditing enabled.
- Test 3 WMI User Account Enumeration
Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\wbem\wmic.exe, CommandLine containing 'useraccount get'. No network events if targeting local system. Security Event ID 4688 with full command line if auditing is enabled.
- Test 4 Linux Multi-Command User Discovery
Expected signal: Linux auditd: SYSCALL records for execve of /usr/bin/whoami, /usr/bin/id, /usr/bin/w, /usr/bin/who, /usr/bin/last, /bin/cat with respective arguments. Syslog entries if auditd is configured to log to syslog. On systems with Sysmon for Linux: EventType=ProcessCreate for each command.
- Test 5 PowerShell Active Directory User Enumeration
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-WmiObject' and 'Win32_UserAccount'. PowerShell ScriptBlock Logging Event ID 4104 in Microsoft-Windows-PowerShell/Operational log with full script content. No AD network queries for local account enumeration.
References (9)
- https://attack.mitre.org/techniques/T1033/
- https://attack.mitre.org/tactics/TA0007/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1033/T1033.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_whoami_execution.yml
- https://www.secureworks.com/research/karagany-backdoor
- https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html
- https://www.cybereason.com/blog/research/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
- https://securelist.com/shadowpad-in-corporate-networks/81432/
- https://us-cert.cisa.gov/ncas/alerts/aa20-239a
Response Playbook
Triage
- Identify the exact command line — was it bare 'whoami' (very common, low risk) or were enumeration flags used (/all, /groups, /priv)? Broader enumeration is more likely adversarial.
- Examine the parent process — was the discovery command spawned by an expected administrative tool, or by a suspicious parent like wscript.exe, mshta.exe, rundll32.exe, or a script interpreter? Unexpected parents are the primary signal here.
- Correlate with timing and user context — did this occur during business hours from the user's own workstation, or outside hours, from a server, or under a service account that would not normally run interactive commands?
- Check for a cluster of discovery commands — T1033 rarely fires alone during real attacks. Look within a 5-10 minute window for co-occurring T1016 (ipconfig, netstat), T1057 (tasklist), T1069 (net group, whoami /groups), T1082 (systeminfo), or T1087 (net user). A cluster of 3+ discovery techniques is a strong indicator.
- Review the process chain — trace from the initiating process upward. Was there a suspicious inbound connection (RDP, WMI, SMB) or phishing artifact (Office document, LNK, ISO) earlier in the chain on this host?
- Assess the value of the compromised user — is this a privileged account (domain admin, service account, local admin)? If so, escalate immediately regardless of other indicators.
Containment
- If the parent process chain leads to a confirmed malicious artifact (dropper, script, Office macro): isolate the endpoint immediately via EDR network isolation or VLAN quarantine.
- If a service account or privileged account context is confirmed: disable the account in Active Directory, revoke Kerberos tickets (klist purge on affected hosts, reset account password to invalidate existing TGTs), and audit recent authentications from that account in AADSignInLogs / SecurityEvent 4624.
- If lateral movement is suspected (same discovery pattern on multiple hosts): isolate all affected hosts, block relevant credentials at the domain controller, and initiate a coordinated response rather than addressing hosts individually.
- If the discovery appears to originate from an external connection: block the source IP at the firewall, review VPN/RDP access logs for the session, and terminate any active sessions from that source.
- Preserve the process tree — before killing any processes, capture a memory dump and process listing (tasklist /v, ps aux) for forensic analysis.
Evidence Collection
- Process Creation Logs — Sysmon Event ID 1 or Security Event ID 4688 (requires 'Audit Process Creation' policy with command line enabled) for the discovery command and its full parent chain.
- Full parent process tree — trace InitiatingProcessId/ParentProcessId back to the originating process. Use 'wmic process get ProcessId,ParentProcessId,Name,CommandLine' or Sysmon correlation.
- Network connection events — Sysmon Event ID 3 or DeviceNetworkEvents for any inbound connections to the host in the 30 minutes preceding discovery activity. Identify potential initial access vector.
- Logon events — Security Event ID 4624/4648 to establish which account was active and how it authenticated (interactive, network, batch). Event ID 4672 for any special privilege assignments.
- PowerShell ScriptBlock Logging — Event ID 4104 from Microsoft-Windows-PowerShell/Operational if discovery was performed via PowerShell, capturing full deobfuscated script content.
- File system artifacts — any scripts, batch files, or executables written to disk in the same session. Review Sysmon Event ID 11 file creation events and prefetch at C:\Windows\Prefetch\.
- Registry — HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU and TypedPaths for recently accessed commands. Also review AmCache.hve and ShimCache for recently executed binaries.
- Scheduled task and service logs — Event ID 4698/4699/4702 (task created/deleted/modified) and 7045 (service installed) to identify any persistence mechanisms established alongside or after discovery.
Escalation Criteria
- !Discovery commands executed under SYSTEM, a service account, or a domain admin context — particularly if the account would have no reason to run interactive discovery tools.
- !Multiple discovery techniques fired within a 5-10 minute window on the same host (T1033 + T1016 + T1082 + T1057 + T1069) — this pattern is characteristic of automated post-exploitation frameworks (Cobalt Strike, Metasploit, Sliver, Havoc).
- !Suspicious parent process — whoami or query user launched by wscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, or a process with a randomly named or temp-directory-resident executable.
- !Discovery originating from a server (not a workstation), especially a domain controller, file server, or database server — adversaries prioritize high-value targets.
- !Evidence of lateral movement: same discovery pattern observed on multiple hosts within a short time window, suggesting automated propagation.
- !Discovery preceded by a suspicious logon — particularly Type 3 (network), Type 10 (remote interactive), or Type 9 (new credentials) logons from unfamiliar source IPs or at unusual hours.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Windows Prefetch: C:\Windows\Prefetch\WHOAMI.EXE-*.pf, QWINSTA.EXE-*.pf, QUERY.EXE-*.pf — timestamps indicate execution history even without process logs. - >
Windows Event Log: Security Event ID 4688 with process command line auditing enabled — captures process creation with full arguments. - >
Sysmon Operational Log: Event ID 1 (Process Create) with CommandLine, ParentImage, ParentCommandLine, User, and IntegrityLevel fields. - >
Registry: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU — recently typed commands in the Run dialog. - >
Shell history: %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt — PowerShell command history for the current user. - >
Bash/Shell history (Linux/macOS): ~/.bash_history, ~/.zsh_history — may contain whoami, w, who, id, finger, last, lastlog commands. - >
Linux /var/log/auth.log or /var/log/secure — records su/sudo usage and login attempts that may accompany user discovery. - >
macOS Unified Log: 'log show --predicate "process == \"dscl\""' — captures dscl usage for user enumeration on macOS endpoints. - >
AmCache.hve and ShimCache — execution evidence for discovery utilities even if logs were cleared, accessible via reg save or volatility plugins.
Tuning Guidance
T1033 is inherently noisy because whoami and query user are used constantly in legitimate administration. The most effective tuning strategy is to focus on context rather than the command itself. First, build a baseline of which hosts routinely see whoami execution and under which parent processes — RDS/Terminal Servers, developer workstations, and build servers will have high legitimate volumes. Suppress alerts from known-good parent processes (explorer.exe, cmd.exe from expected admin accounts) via allowlists. The highest-fidelity signal is the discovery cluster pattern: a single whoami rarely matters, but whoami + ipconfig + tasklist + systeminfo within 10 minutes is almost always malicious. Tune toward RiskScore >= 2 (suspicious parent + enriched flags) for automated alerting, and use the cluster hunting query for proactive threat hunting. On Linux and macOS endpoints, 'w', 'who', and 'id' are even noisier than whoami on Windows — focus Linux detection on id or who spawned from cron jobs, web server processes (nginx, apache), or database processes (mysql, postgres), which would indicate web shell or service account compromise. For high-security environments (domain controllers, PAM servers), consider alerting on any whoami execution that is not from a known admin tool, as user discovery on these systems from unexpected processes is always anomalous.
Hunting Queries
Hunt for discovery command clusters — 3 or more distinct discovery utilities executed within a 10-minute window by the same user on the same host. This pattern is characteristic of post-exploitation frameworks performing automated environment enumeration (Cobalt Strike's 'run' commands, Meterpreter's 'sysinfo'/'getuid', Sliver's 'info' module). A cluster of discovery tools in a short window is a high-fidelity indicator of active compromise.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("whoami.exe", "query.exe", "qwinsta.exe", "quser.exe", "wmic.exe", "net.exe", "net1.exe", "systeminfo.exe", "ipconfig.exe", "tasklist.exe", "netstat.exe")
| summarize
DiscoveryCommands = make_set(FileName),
CommandCount = count(),
CommandLines = make_set(ProcessCommandLine),
FirstSeen = min(Timestamp),
LastSeen = max(Timestamp)
by DeviceName, AccountName, bin(Timestamp, 10m)
| where array_length(DiscoveryCommands) >= 3
| extend DiscoverySpread = datetime_diff('minute', LastSeen, FirstSeen)
| sort by array_length(DiscoveryCommands) desc, CommandCount descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\whoami.exe" OR Image="*\\query.exe" OR Image="*\\qwinsta.exe" OR Image="*\\quser.exe"
OR Image="*\\wmic.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe"
OR Image="*\\systeminfo.exe" OR Image="*\\ipconfig.exe" OR Image="*\\tasklist.exe" OR Image="*\\netstat.exe")
| bin _time span=10m
| stats dc(Image) as UniqueTools, count as CmdCount, values(Image) as ToolsUsed, values(CommandLine) as CommandLines by _time, host, User
| where UniqueTools >= 3
| sort - UniqueTools, - CmdCountHunt for whoami executed by known Living Off The Land Binaries (LOLBins) commonly used in initial access and execution phases. These parent-child relationships are abnormal — legitimate administrative use of whoami is typically invoked from cmd.exe, PowerShell, or batch scripts, not from script hosts or proxy execution binaries. Any match here warrants immediate investigation as it strongly suggests malware or script-based initial access performing initial reconnaissance.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "whoami.exe"
| where InitiatingProcessFileName in~ (
"wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe",
"regsvr32.exe", "msbuild.exe", "installutil.exe", "cmstp.exe",
"odbcconf.exe", "ieexec.exe", "msconfig.exe"
)
| project Timestamp, DeviceName, AccountName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
InitiatingProcessParentFileName
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
Image="*\\whoami.exe"
(ParentImage="*\\wscript.exe" OR ParentImage="*\\cscript.exe" OR ParentImage="*\\mshta.exe"
OR ParentImage="*\\rundll32.exe" OR ParentImage="*\\regsvr32.exe" OR ParentImage="*\\msbuild.exe"
OR ParentImage="*\\installutil.exe" OR ParentImage="*\\cmstp.exe" OR ParentImage="*\\odbcconf.exe")
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine
| sort - _timeHunt for anomalous spikes in whoami execution volume per host, which may indicate automated post-exploitation activity or worm-like lateral movement. A sudden 5x increase above baseline on a host is suspicious — legitimate environments rarely see dramatic spikes in user discovery activity. Malware families like TrickBot, Emotet, and APT38 tools perform automated user enumeration at scale when spreading across an environment.
let WindowsDiscovery = DeviceProcessEvents
| where Timestamp > ago(14d)
| where FileName =~ "whoami.exe"
| summarize Count=count() by DeviceName, AccountName, dayofweek=bin(Timestamp, 1d)
| summarize AvgPerDay=avg(Count), MaxDay=max(Count) by DeviceName, AccountName;
WindowsDiscovery
| where MaxDay > (AvgPerDay * 5) and MaxDay > 10
| sort by MaxDay descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\whoami.exe"
| timechart span=1d count by host
| eval RollingAvg=mvavg(host, 7)
| where host > (RollingAvg * 5) AND host > 10Atomic Red Team Tests
Executes whoami with /all flag to enumerate the current user's name, SID, group memberships, and privilege assignments in a single command. This is the most common single-command user enumeration pattern used by post-exploitation frameworks and malware (BabyShark, WellMess, TrickBot) immediately after initial access to understand the access level of the compromised account.
Command
whoami /allExpected Telemetry
Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\whoami.exe, CommandLine='whoami /all', ParentImage=cmd.exe or calling shell. Security Event ID 4688 if command line auditing is enabled. No network events expected.
Expected Detection
KQL: FileName='whoami.exe' with ProcessCommandLine has '/all'. RiskScore increments for EnrichedFlags. SPL: EnrichedFlags=1. Alert fires because /all flag is present.
Executes query user (alias: quser) to enumerate all currently logged-in user sessions including session ID, session name, state (active/disconnected), idle time, and logon time. This is used by adversaries to identify active users who might notice suspicious activity, or to find high-value targets with active sessions (domain admins, executives). Malware like PoetRAT and NDiskMonitor collect this information before exfiltrating or escalating.
Command
query userExpected Telemetry
Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\query.exe, CommandLine='query user'. Alternatively may appear as quser.exe. Security Event ID 4688 with command line auditing enabled.
Expected Detection
KQL: FileName='query.exe' match in the detection logic. SPL: Image matches *\\query.exe. RiskScore will include EnrichedFlags=1 since query user is always substantive enumeration.
Uses wmic to enumerate all local user accounts including account name, SID, password requirements, and account status. This WMI-based approach is favored by malware and adversaries because it does not require net.exe (which is commonly monitored) and can query remote systems. TrickBot and ShadowPad both use WMI-based user enumeration as part of their reconnaissance phase.
Command
wmic useraccount get Name,SID,Status,PasswordRequired,PasswordExpiresExpected Telemetry
Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\wbem\wmic.exe, CommandLine containing 'useraccount get'. No network events if targeting local system. Security Event ID 4688 with full command line if auditing is enabled.
Expected Detection
KQL: FileName='wmic.exe' AND ProcessCommandLine has 'useraccount'. SPL: Image matches wmic.exe AND CommandLine matches useraccount. EnrichedFlags=1, RiskScore >= 1.
Executes a sequence of user discovery commands on Linux that mirrors automated post-exploitation reconnaissance. whoami identifies the current user, id shows UID/GID and group memberships, w lists logged-in users with session details, and who provides login times. This sequence is characteristic of shell-based malware (WellMess, PoetRAT Linux variants) performing initial environment fingerprinting over SSH or after web shell access.
Command
whoami && id && w && who && last -n 5 && cat /etc/passwd | grep -v nologin | grep -v falseExpected Telemetry
Linux auditd: SYSCALL records for execve of /usr/bin/whoami, /usr/bin/id, /usr/bin/w, /usr/bin/who, /usr/bin/last, /bin/cat with respective arguments. Syslog entries if auditd is configured to log to syslog. On systems with Sysmon for Linux: EventType=ProcessCreate for each command.
Expected Detection
SPL hunting query against linux_secure or auditd sourcetype should show rapid sequential execution of multiple user discovery commands. For Sysmon for Linux: EventCode=1 with Image matching whoami/id/w/who/last. Temporal clustering query will flag 5 discovery commands within seconds.
Uses PowerShell with the ActiveDirectory module to enumerate domain users matching a wildcard, collecting user properties including account status and last logon. This pattern is used by adversaries with domain credentials to identify high-value accounts for targeting. DRATzarus (Lazarus Group) and APT38 tools perform AD enumeration as part of their discovery phase to identify administrator and service accounts.
Command
powershell.exe -NoProfile -Command "Get-WmiObject -Class Win32_UserAccount -Filter 'LocalAccount=True' | Select-Object Name, SID, Disabled, PasswordRequired | Format-List"Expected Telemetry
Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-WmiObject' and 'Win32_UserAccount'. PowerShell ScriptBlock Logging Event ID 4104 in Microsoft-Windows-PowerShell/Operational log with full script content. No AD network queries for local account enumeration.
Expected Detection
KQL: FileName='powershell.exe' AND ProcessCommandLine has 'Win32_UserAccount'. SPL: Image matches powershell.exe AND CommandLine matches Win32_UserAccount. EnrichedFlags=1 due to WMI user account pattern. RiskScore >= 1.