Procedure examples

Storm-1811 has used `whoami.exe` to determine if the active user on a compromised system is an administrator.

FIN7 has used the command `cmd.exe /C quser` to collect user session information.

Sandworm Team has collected the username from a compromised host.

Sidewinder has used tools to identify the user of a compromised host.

ZIRCONIUM has used a tool to capture the username on a compromised host in order to register it with C2.

APT39 used Remexi to collect usernames from the system.

APT37 identifies the victim username.

OilRig has run whoami on a victim.

Tropic Trooper used letmein to scan for saved usernames on the target system.

Aquatic Panda gathers information on recently logged-in users on victim devices.

Ke3chang has used implants capable of collecting the signed-in username.

Winter Vivern PowerShell scripts execute `whoami` to identify the executing user.

Stealth Falcon malware gathers the registered user and primary owner name via WMI.

Chimera has used the quser command to show currently logged on users.

MirrorFace has used Windows native tools to enumerate user information.

Medusa Group has utilized PsExec to execute `quser` to discover the user session information.

Windshift has used malware to identify the username on a compromised host.

LuminousMoth has used a malicious DLL to collect the username from compromised hosts.

Various Lazarus Group malware enumerates logged-on users.

Earth Lusca collected information on user accounts via the whoami command.

Wizard Spider has used "whoami" to identify the local user and their privileges.

Moonstone Sleet deployed various malware such as YouieLoader that can perform system user discovery actions.

HEXANE has run `whoami` on compromised machines to identify the current user.

Magic Hound malware has obtained the victim username and sent it to the C2 server.

Threat Group-3390 has used `whoami` to collect system user information.

FIN10 has used Meterpreter to enumerate users on remote systems.

FIN8 has executed the command `quser` to display the session details of a compromised machine.

APT19 used an HTTP malware variant and a Port 22 malware variant to collect the victim’s username.

menuPass has used esentutl to change file extensions to their true type that were masquerading as .txt files.

APT32 has disguised a Cobalt Strike beacon as a Flash Installer.

Storm-1811 has prompted users to download and execute batch scripts that masquerade as legitimate update files during initial access and social engineering operations.

TeamTNT has disguised their scripts with docker-related file names.

Sandworm Team masqueraded malicious installers as Windows update packages to evade defense and entice users to execute binaries.

ZIRCONIUM has spoofed legitimate applications in phishing lures and changed file extensions to conceal installation of malware.

Contagious Interview has delivered BeaverTail malware masquerading as legitimate software or applications. Contagious Interview has also delivered malicious payloads masquerading as legitimate software drivers.

OilRig has used .doc file extensions to mask malicious executables.

Aoqin Dragon has used fake icons including antivirus and external drives to disguise malicious payloads.

Winter Vivern created specially-crafted documents mimicking legitimate government or similar documents during phishing campaigns.

BRONZE BUTLER has masked executables with document file icons including Word and Adobe PDF.

TA551 has masked malware DLLs as dat and jpg files.

Ember Bear has renamed the legitimate Sysinternals tool procdump to alternative names such as dump64.exe to evade detection.

LazyScripter has used several different security software icons to disguise executables.

Windshift has used icons mimicking MS Office files to mask malicious executables. Windshift has also attempted to hide executables by changing the file extension to ".scr" to mimic Windows screensavers.

Agrius used the Plink tool for tunneling and connections to remote machines, renaming it systems.exe in some instances.

APT28 has renamed the WinRAR utility to avoid detection.

PLATINUM has renamed rar.exe to avoid detection.

FIN13 has masqueraded staged data by using the Windows certutil utility to generate fake Base64 encoded certificates with the input file.

Nomadic Octopus attempted to make Octopus appear as a Telegram Messenger with a Russian interface.

APT37 has signed its malware with an invalid digital certificates listed as “Tencent Technology (Shenzhen) Company Limited.”

Windshift has used revoked certificates to sign malware.