Windows Local Account Discovery via System Utilities Process Execution
Flags Windows processes that match utilities used to enumerate local user and account information.
- Product
- windows
- Category
- process_creation
- Author
- Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2019-10-21
- Updated
- 2026-07-30
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows process activity consistent with local account enumeration using common built-in tools. It matches command-line and image patterns for utilities such as whoami.exe, quser.exe, qwinsta.exe, wmic.exe (useraccount get), cmdkey.exe ("/l"), cmd.exe executing directory listing under \Users\, and net.exe/net1.exe with discovery-related user arguments. Local account discovery is a key attacker step for mapping accessible accounts and tailoring follow-on actions, and the detection relies on process creation telemetry including Image and CommandLine fields.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Local Account Discovery via System Utilities Process Execution
id: a05dade9-d006-4a79-9fa8-0b99c7598cd1
status: test
related:
- id: e28a5a99-da44-436d-b7a0-2afc20a5f413
type: obsolete
- id: 502b42de-4306-40b4-9596-6f590c81f073
type: derived
description: This rule identifies Windows process activity consistent with local account enumeration using common built-in tools. It matches command-line and image patterns for utilities such as whoami.exe, quser.exe, qwinsta.exe, wmic.exe (useraccount get), cmdkey.exe ("/l"), cmd.exe executing directory listing under \Users\, and net.exe/net1.exe with discovery-related user arguments. Local account discovery is a key attacker step for mapping accessible accounts and tailoring follow-on actions, and the detection relies on process creation telemetry including Image and CommandLine fields.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_local_system_owner_account_discovery.yml
author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2019-10-21
modified: 2025-10-20
tags:
- attack.discovery
- attack.t1033
- attack.t1087.001
logsource:
category: process_creation
product: windows
detection:
selection_other_img:
- Image|endswith:
- \whoami.exe
- \quser.exe
- \qwinsta.exe
- OriginalFileName:
- whoami.exe
- quser.exe
- qwinsta.exe
selection_other_wmi:
Image|endswith: \wmic.exe
CommandLine|contains|all:
- useraccount
- get
selection_other_cmdkey:
Image|endswith: \cmdkey.exe
CommandLine|contains: " /l"
selection_cmd:
Image|endswith: \cmd.exe
CommandLine|contains|all:
- " /c"
- "dir "
- \Users\
filter_cmd:
CommandLine|contains: " rmdir "
selection_net:
Image|endswith:
- \net.exe
- \net1.exe
CommandLine|contains: user
filter_net:
CommandLine|contains:
- /domain
- /add
- /delete
- /active
- /expires
- /passwordreq
- /scriptpath
- /times
- /workstations
condition: (selection_cmd and not filter_cmd) or (selection_net and not filter_net) or 1 of selection_other_*
falsepositives:
- Legitimate administrator or user enumerates local users for legitimate reason
level: low
simulation:
- type: atomic-red-team
name: WMI Reconnaissance Users
technique: T1047
atomic_guid: c107778c-dcf5-47c5-af2e-1d058a3df3ea
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_susp_local_system_owner_account_discovery/info.yml
license: DRL-1.1