T1033

Description from ATT&CK

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping. The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Various utilities and commands may acquire this information, including whoami. In macOS and Linux, the currently logged in user can be identified with w and who. On macOS the dscl . list /Users | grep -v '_' command can also be used to enumerate user accounts. Environment variables, such as %USERNAME% and $USER, may also be used to access this information.

On network devices, Network Device CLI commands such as show users and show ssh can be used to display users currently logged into the device.(Citation: show_ssh_users_cmd_cisco)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)

Tests

Test #1 - Get user (using System Info)

Retrieves the current user's short and long names using the system info command.

short user name of (system info)
long user name of (system info)

Download Files

Test #2 - Get user (using environment variable)

Retrieves the current user's username using the USER environment variable.

system attribute "USER"

Download Files

Test #3 - Get user (using list folder)

By default, the user's home directory is /Users/username. Listing the /Users folder will return the list of users on the system.

list folder "/Users"

Download Files

Test #4 - Get user information (using System Events JXA)

Retrieves the current user's username using the System Events JXA command.

const app = Application("System Events")
const user = app.currentUser();
const longName = user.fullName();
const shortName = user.name();
const userHome = user.homeDirectory();

`Name: ${longName}
Username: ${shortName}
Home Directory: ${userHome}`

Download Files

References

• MITRE ATT&CK T1033
• Apple Script Language Guide