Linux System Owner or User Discovery via Common Utility Execution

Flags execution of Linux user/system identification utilities such as whoami and id.

FreeReviewedSigma · Low · v3

Product: linux
Service: auditd
Author: Timur Zinniatullin, oscd.community (SigmaHQ), DRL 1.1
Published: 2019-10-21
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1033System Owner/User Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies execution events for common Linux system owner and user discovery utilities such as whoami, hostname, id, uname, users, w, who, and last. Adversaries often run these commands during automated discovery to gather context about the host and current user, which can influence subsequent actions. The detection relies on Linux auditd telemetry capturing process execution (EXECVE) for the specified command names.

Reporting behind it

Related detections9 linkedT1033 — drag to rearrange

Suspicious Whoami Execution With Output Redirected to a File (via process_creation)

Possible Logged-On Session Discovery via Quser or Qwinsta (via process_creation)

Suspicious Reconnaissance Spawned by Injected SearchProtocolHost via process_creation

Windows Process Creation: whoami.exe Executed With /all for Full Identity Enumeration

Linux Process Execution of esxcli Network Commands for ESXi Network Discovery

Linux Process Execution of esxcli VM Listing Commands

Linux ESXi esxcli VSAN Information Discovery via esxcli Command

Linux Process Creation: ESXi esxcli system discovery via system namespace

Linux ESXi esxcli Storage Information Discovery via esxcli storage commands

Linux System Owner or User Discovery via Common Utility Execution

Pivot detection · T1033 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-system-owner-and-user-discovery-via-utility-execution-9a0d8ca0

title: Linux System Owner or User Discovery via Common Utility Execution
id: 70e4fb99-555e-4f75-ac35-2088fc2d46cb
status: test
description: This rule identifies execution events for common Linux system owner and user discovery utilities such as whoami, hostname, id, uname, users, w, who, and last. Adversaries often run these commands during automated discovery to gather context about the host and current user, which can influence subsequent actions. The detection relies on Linux auditd telemetry capturing process execution (EXECVE) for the specified command names.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_user_discovery.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2019-10-21
modified: 2025-06-04
tags:
  - attack.discovery
  - attack.t1033
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
    a0:
      - hostname
      - id
      - last
      - uname
      - users
      - w
      - who
      - whoami
  condition: selection
falsepositives:
  - Admin activity
level: low
license: DRL-1.1
related:
  - id: 9a0d8ca0-2385-4020-b6c6-cb6153ca56f3
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL