Linux System Owner and User Discovery via Utility Execution

title: Linux System Owner and User Discovery via Utility Execution
id: 70e4fb99-555e-4f75-ac35-2088fc2d46cb
status: test
description: This rule detects execution of common Linux utilities used for system owner and user discovery, including whoami, id, hostname, uname, users, and who. Such information-gathering supports automated reconnaissance to tailor follow-on actions, including targeting decisions and host/user-specific behavior. It relies on Linux auditd telemetry that captures process execution events of type EXECVE for the listed commands.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_user_discovery.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2019-10-21
modified: 2025-06-04
tags:
  - attack.discovery
  - attack.t1033
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
    a0:
      - hostname
      - id
      - last
      - uname
      - users
      - w
      - who
      - whoami
  condition: selection
falsepositives:
  - Admin activity
level: low
license: DRL-1.1
related:
  - id: 9a0d8ca0-2385-4020-b6c6-cb6153ca56f3
    type: derived