Windows PowerShell User Discovery via Current Username APIs
Alerts on PowerShell script blocks that retrieve the current username or user identity using common environment/.NET calls.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-04-04
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script block text that attempts to determine the current logged-in user by referencing username-related environment variables and .NET identity APIs. User discovery helps attackers tailor follow-on actions and validate execution context, so frequent or unexpected usage can be suspicious. It relies on Script Block Logging telemetry capturing PowerShell script content containing the specific username expressions.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md#atomic-test-4---user-discovery-with-env-vars-powershell-script
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md#atomic-test-5---getcurrent-user-with-powershell-script
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_get_current_user.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell User Discovery via Current Username APIs
id: f3890c42-6a2b-456d-8c6e-06f4aad57bf1
status: test
description: This rule flags PowerShell script block text that attempts to determine the current logged-in user by referencing username-related environment variables and .NET identity APIs. User discovery helps attackers tailor follow-on actions and validate execution context, so frequent or unexpected usage can be suspicious. It relies on Script Block Logging telemetry capturing PowerShell script content containing the specific username expressions.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md#atomic-test-4---user-discovery-with-env-vars-powershell-script
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md#atomic-test-5---getcurrent-user-with-powershell-script
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_get_current_user.yml
author: frack113, Huntrule Team
date: 2022-04-04
tags:
- attack.discovery
- attack.t1033
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains:
- "[System.Environment]::UserName"
- $env:UserName
- "[System.Security.Principal.WindowsIdentity]::GetCurrent()"
condition: selection
falsepositives:
- Legitimate PowerShell scripts
level: low
license: DRL-1.1
related:
- id: 4096a49c-7de4-4da0-a230-c66ccd56ea5a
type: derived