Linux System Owner or User Discovery via Common Utility Execution

Flags execution of Linux user/system identification utilities such as whoami and id.

FreeReviewedSigma · Low · v3

Product: linux
Service: auditd
Author: Timur Zinniatullin, oscd.community (SigmaHQ), DRL 1.1
Published: 2019-10-21
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1033System Owner/User Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies execution events for common Linux system owner and user discovery utilities such as whoami, hostname, id, uname, users, w, who, and last. Adversaries often run these commands during automated discovery to gather context about the host and current user, which can influence subsequent actions. The detection relies on Linux auditd telemetry capturing process execution (EXECVE) for the specified command names.

Reporting behind it

Related detections9 linkedT1033 — drag to rearrange

Suspicious Whoami Discovery Spawned by Windows Script Host via Process Creation (via process_creation)

Suspicious Localized Administrator Account and Group Enumeration After Citrix Bleed Exploitation

Malicious Recon Output Staged in Qlik Sense Fonts Directory by Cactus Ransomware

Suspicious Host Reconnaissance Command Chain via cmd

Malicious Child Process Spawned From n8n Node Process

Suspicious Credential Enumeration via cmdkey List

Suspicious IIS Worker Process Spawning Whoami Reconnaissance

Suspicious Whoami Execution With Output Redirected to a File (via process_creation)

Possible Logged-On Session Discovery via Quser or Qwinsta (via process_creation)

Linux System Owner or User Discovery via Common Utility Execution

Pivot detection · T1033 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-system-owner-and-user-discovery-via-utility-execution-9a0d8ca0

title: Linux System Owner or User Discovery via Common Utility Execution
id: 70e4fb99-555e-4f75-ac35-2088fc2d46cb
status: test
description: This rule identifies execution events for common Linux system owner and user discovery utilities such as whoami, hostname, id, uname, users, w, who, and last. Adversaries often run these commands during automated discovery to gather context about the host and current user, which can influence subsequent actions. The detection relies on Linux auditd telemetry capturing process execution (EXECVE) for the specified command names.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_user_discovery.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2019-10-21
modified: 2025-06-04
tags:
  - attack.discovery
  - attack.t1033
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
    a0:
      - hostname
      - id
      - last
      - uname
      - users
      - w
      - who
      - whoami
  condition: selection
falsepositives:
  - Admin activity
level: low
license: DRL-1.1
related:
  - id: 9a0d8ca0-2385-4020-b6c6-cb6153ca56f3
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL