Procedure examples

APT38 has identified primary users, currently logged in users, sets of users that commonly use a system, or inactive users.

GALLIUM used whoami and query user to obtain information about the victim user.

An APT3 downloader uses the Windows command "cmd.exe" /C whoami to verify that it is running with the elevated privileges of “System.”

Kimsuky has gathered the identity of the user by querying `System.Security.Principal` namespace using the `GetCurrent()` method.

Volt Typhoon has used public tools and executed the PowerShell command `Get-EventLog security -instanceid 4624` to identify associated user and computer account names.

Patchwork collected the victim username and whether it was running as admin, then sent the information to its C2 server.

APT41 has executed whoami commands, including using the WMIEXEC utility to execute this on remote machines.

Dragonfly used the command query user on victim hosts.

APT32 collected the victim's username and executed the whoami command on the victim's machine. APT32 executed shellcode to collect the username on the victim's machine.

HAFNIUM has used `whoami` to gather user information.

MuddyWater has used malware that can collect the victim’s username.

A Gamaredon Group file stealer can gather the victim's username to send to a C2 server.

Storm-1811 has used `whoami.exe` to determine if the active user on a compromised system is an administrator.

FIN7 has used the command `cmd.exe /C quser` to collect user session information.

Sandworm Team has collected the username from a compromised host.

Sidewinder has used tools to identify the user of a compromised host.

ZIRCONIUM has used a tool to capture the username on a compromised host in order to register it with C2.

APT39 used Remexi to collect usernames from the system.

APT37 identifies the victim username.

OilRig has run whoami on a victim.

Tropic Trooper used letmein to scan for saved usernames on the target system.

Aquatic Panda gathers information on recently logged-in users on victim devices.

Ke3chang has used implants capable of collecting the signed-in username.

Winter Vivern PowerShell scripts execute `whoami` to identify the executing user.

Stealth Falcon malware gathers the registered user and primary owner name via WMI.

Chimera has used the quser command to show currently logged on users.

MirrorFace has used Windows native tools to enumerate user information.

Medusa Group has utilized PsExec to execute `quser` to discover the user session information.

Windshift has used malware to identify the username on a compromised host.

LuminousMoth has used a malicious DLL to collect the username from compromised hosts.

Various Lazarus Group malware enumerates logged-on users.

Earth Lusca collected information on user accounts via the whoami command.

Wizard Spider has used "whoami" to identify the local user and their privileges.

Moonstone Sleet deployed various malware such as YouieLoader that can perform system user discovery actions.

HEXANE has run `whoami` on compromised machines to identify the current user.

Magic Hound malware has obtained the victim username and sent it to the C2 server.

Threat Group-3390 has used `whoami` to collect system user information.

FIN10 has used Meterpreter to enumerate users on remote systems.

FIN8 has executed the command `quser` to display the session details of a compromised machine.

APT19 used an HTTP malware variant and a Port 22 malware variant to collect the victim’s username.