Windows PowerShell User Discovery via GetCurrent User and Environment Variables

Alerts on PowerShell script blocks that retrieve the current username or user identity using common environment/.NET calls.

FreeUnreviewedSigmalowv1

windows-powershell-user-discovery-via-getcurrent-user-and-environment-variables-4096a49c

title: Windows PowerShell User Discovery via GetCurrent User and Environment Variables
id: f3890c42-6a2b-456d-8c6e-06f4aad57bf1
status: test
description: This rule flags PowerShell script activity that attempts to determine the current logged-on user using common .NET and environment-value lookups. User discovery helps attackers tailor subsequent actions, gather context for targeted activity, or prepare for privilege- and access-related steps. It relies on Script Block Logging telemetry by matching script content for specific user-retrieval expressions such as [System.Environment]::UserName, $env:UserName, and WindowsIdentity GetCurrent().
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md#atomic-test-4---user-discovery-with-env-vars-powershell-script
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md#atomic-test-5---getcurrent-user-with-powershell-script
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_get_current_user.yml
author: frack113, Huntrule Team
date: 2022-04-04
tags:
  - attack.discovery
  - attack.t1033
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - "[System.Environment]::UserName"
      - $env:UserName
      - "[System.Security.Principal.WindowsIdentity]::GetCurrent()"
  condition: selection
falsepositives:
  - Legitimate PowerShell scripts
level: low
license: DRL-1.1
related:
  - id: 4096a49c-7de4-4da0-a230-c66ccd56ea5a
    type: derived

What it detects

This rule flags PowerShell script activity that attempts to determine the current logged-on user using common .NET and environment-value lookups. User discovery helps attackers tailor subsequent actions, gather context for targeted activity, or prepare for privilege- and access-related steps. It relies on Script Block Logging telemetry by matching script content for specific user-retrieval expressions such as [System.Environment]::UserName, $env:UserName, and WindowsIdentity GetCurrent().

Known false positives

Legitimate PowerShell scripts

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.