Procedure examples

Bonadan has discovered the username of the user running the backdoor.

Neoichor can collect the user name from a victim's machine.

Raspberry Robin determines whether it is successfully running on a victim system by querying the running account information to determine if it is running in Session 0, indicating running with elevated privileges.

Diavol can collect the username from a compromised host.

RustyWater has gathered the victim machine’s username.

BlackCat can utilize `net use` commands to discover the user name on a compromised host.

VERMIN gathers the username from the victim’s machine.

Nightdoor gathers information on victim system users and usernames.

MarkiRAT can retrieve the victim’s username.

PowerShower has the ability to identify the current user on the infected host.

Kazuar gathers information on users.

DarkComet gathers the username from the victim’s machine.

CHIMNEYSWEEP has included the victim's computer name and username in C2 messages sent to actor-owned infrastructure.

Lucifer has the ability to identify the username on a compromised host.

zwShell can obtain the name of the logged-in user on the victim.

DRATzarus can obtain a list of users from an infected machine.

Rising Sun can detect the username of the infected host.

Chrommme can retrieve the username from a targeted system.

ObliqueRAT can check for blocklisted usernames on infected endpoints.

SocGholish can use `whoami` to obtain the username from a compromised host.

Flagpro has been used to run the whoami command on the system.

XAgentOSX contains the getInfoOSX function to return the OS X version as well as the current user.

ROKRAT can collect the username from a compromised host.

DarkWatchman has collected the username from a victim machine.

Dyre has the ability to identify the users on a compromised host.

PlugX has the ability to gather the username from the victim’s machine.

Reaver collects the victim's username.

S-Type has run tests to determine the privilege level of the compromised user.

Remsec can obtain information about the current user.

Explosive has collected the username from the infected host.

Epic collects the user name from the victim’s machine.

Clambling can identify the username on a compromised host.

PureCrypter can retrieve the username from targeted machines.

NanHaiShu collects the username from the victim.

SVCReady can collect the username from an infected host.

NGLite will run the whoami command to gather system information and return this to the command and control server.

SHARPSTATS has the ability to identify the username on the compromised host.

Caterpillar WebShell can obtain a list of user accounts from a victim's machine.

Gazer obtains the current user's security identifier.

Latrodectus can discover the username of an infected host.

Saint Bot can collect the username from a compromised host.

Chaes has collected the username and UID from the infected machine.

LODEINFO can identify the associated username on targeted machines.

EVILNUM can obtain the username from the victim's machine.

SMOKEDHAM has used whoami commands to identify system owners.

QUADAGENT gathers the victim username.

Sys10 collects the account name of the logged-in user and sends it to the C2.

Metamorfo has collected the username from the victim's machine.

Trojan.Karagany can gather information about the user on a compromised host.

KONNI can collect the username from the victim’s machine.