huntrule

Windows Local Account Discovery via System Utilities Process Execution

Flags Windows processes that match utilities used to enumerate local user and account information.

FreeUnreviewedSigmalowv1
title: Windows Local Account Discovery via System Utilities Process Execution
id: a05dade9-d006-4a79-9fa8-0b99c7598cd1
status: test
related:
  - id: e28a5a99-da44-436d-b7a0-2afc20a5f413
    type: obsolete
  - id: 502b42de-4306-40b4-9596-6f590c81f073
    type: derived
description: This rule identifies Windows process activity consistent with local account enumeration using common built-in tools. It matches command-line and image patterns for utilities such as whoami.exe, quser.exe, qwinsta.exe, wmic.exe (useraccount get), cmdkey.exe ("/l"), cmd.exe executing directory listing under \Users\, and net.exe/net1.exe with discovery-related user arguments. Local account discovery is a key attacker step for mapping accessible accounts and tailoring follow-on actions, and the detection relies on process creation telemetry including Image and CommandLine fields.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_local_system_owner_account_discovery.yml
author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2019-10-21
modified: 2025-10-20
tags:
  - attack.discovery
  - attack.t1033
  - attack.t1087.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_other_img:
    - Image|endswith:
        - \whoami.exe
        - \quser.exe
        - \qwinsta.exe
    - OriginalFileName:
        - whoami.exe
        - quser.exe
        - qwinsta.exe
  selection_other_wmi:
    Image|endswith: \wmic.exe
    CommandLine|contains|all:
      - useraccount
      - get
  selection_other_cmdkey:
    Image|endswith: \cmdkey.exe
    CommandLine|contains: " /l"
  selection_cmd:
    Image|endswith: \cmd.exe
    CommandLine|contains|all:
      - " /c"
      - "dir "
      - \Users\
  filter_cmd:
    CommandLine|contains: " rmdir "
  selection_net:
    Image|endswith:
      - \net.exe
      - \net1.exe
    CommandLine|contains: user
  filter_net:
    CommandLine|contains:
      - /domain
      - /add
      - /delete
      - /active
      - /expires
      - /passwordreq
      - /scriptpath
      - /times
      - /workstations
  condition: (selection_cmd and not filter_cmd) or (selection_net and not filter_net) or 1 of selection_other_*
falsepositives:
  - Legitimate administrator or user enumerates local users for legitimate reason
level: low
simulation:
  - type: atomic-red-team
    name: WMI Reconnaissance Users
    technique: T1047
    atomic_guid: c107778c-dcf5-47c5-af2e-1d058a3df3ea
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_susp_local_system_owner_account_discovery/info.yml
license: DRL-1.1

What it detects

This rule identifies Windows process activity consistent with local account enumeration using common built-in tools. It matches command-line and image patterns for utilities such as whoami.exe, quser.exe, qwinsta.exe, wmic.exe (useraccount get), cmdkey.exe ("/l"), cmd.exe executing directory listing under \Users\, and net.exe/net1.exe with discovery-related user arguments. Local account discovery is a key attacker step for mapping accessible accounts and tailoring follow-on actions, and the detection relies on process creation telemetry including Image and CommandLine fields.

Known false positives

  • Legitimate administrator or user enumerates local users for legitimate reason

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.