Procedure examples

TrickBot can identify the user and groups the user belongs to on a compromised host.

PowerDuke has commands to get the current user's name and SID.

RCSession can gather system owner information, including user and administrator privileges.

Spark has run the whoami command and has a built-in command to identify the user logged in.

SynAck gathers user names from infected hosts.

Bumblebee has the ability to identify the user name.

Amadey has collected the user name from a compromised host using `GetUserNameA`.

NOKKI can collect the username from the victim’s machine.

yty collects the victim’s username.

Backdoor.Oldrea collects the current username from the victim.

IronWind can enumerate the username on victim's systems.

Get2 has the ability to identify the current username of an infected host.

POWRUNER may collect information about the currently logged in user by running whoami on a victim.

KOPILUWAK can conduct basic network reconnaissance on the victim machine with `whoami`, to get user details.

Linux Rabbit opens a socket on port 22 and if it receives a response it attempts to obtain the machine's hostname and Top-Level Domain.

Exaramel for Linux can run whoami to identify the system owner.

HAWKBALL can collect the user name of the system.

RedLeaves can obtain information about the logged on user both locally and for Remote Desktop sessions.

Felismus collects the current username and sends it to the C2 server.

Havoc can trigger exection of `whoami` on the target host to display the current user.

GravityRAT collects the victim username along with other account information (account type, description, full name, SID and status).

InvisibleFerret has identified the user’s UUID and username through the "pay" module.

can collect the victim user name.

WinMM uses NetUser-GetInfo to identify that it is running under an “Admin” account on the local system.

TONESHELL has obtained the username from an infected host.

PyDCrypt has probed victim machines with whoami and has collected the username from the machine.

BOOKWORM has obtained the username from an infected host.

SslMM sends the logged-on username to its hard-coded C2.

Aria-body has the ability to identify the username on a compromised host.

Emotet has enumerated all users connected to network shares.

Crimson can identify the user on a targeted system.

Turian can retrieve usernames.

BADHATCH can obtain logged user information from a compromised machine and can execute the command `whoami.exe`.

Action RAT has the ability to collect the username from an infected host.

A module in Prikormka collects information from the victim about the current user name.

PUBLOAD has obtained the username from an infected host.

WellMess can collect the username on the victim machine to send to C2.

Woody RAT can retrieve a list of user accounts and usernames from an infected machine.

Mafalda can collect the username from a compromised host.

Squirrelwaffle can collect the user name from a compromised host.

HexEval Loader has collected the username from the victim host.

AuTo Stealer has the ability to collect the username from an infected host.

Agent.btz obtains the victim username and saves it to a file.

SombRAT can execute getinfo to identify the username on a compromised host.

FlawedAmmyy enumerates the current user during the initial infection.

Rifdoor has the ability to identify the username on the compromised host.

Cuckoo Stealer can discover and send the username from a compromised host to C2.

InvisiMole lists local users and session information.

WINERACK can gather information on the victim username.

Okrum can collect the victim username.