Procedure examples

BADHATCH can obtain logged user information from a compromised machine and can execute the command `whoami.exe`.

Action RAT has the ability to collect the username from an infected host.

A module in Prikormka collects information from the victim about the current user name.

PUBLOAD has obtained the username from an infected host.

WellMess can collect the username on the victim machine to send to C2.

Woody RAT can retrieve a list of user accounts and usernames from an infected machine.

Mafalda can collect the username from a compromised host.

Squirrelwaffle can collect the user name from a compromised host.

HexEval Loader has collected the username from the victim host.

AuTo Stealer has the ability to collect the username from an infected host.

Agent.btz obtains the victim username and saves it to a file.

SombRAT can execute getinfo to identify the username on a compromised host.

FlawedAmmyy enumerates the current user during the initial infection.

Rifdoor has the ability to identify the username on the compromised host.

Cuckoo Stealer can discover and send the username from a compromised host to C2.

InvisiMole lists local users and session information.

WINERACK can gather information on the victim username.

Okrum can collect the victim username.

Bonadan has discovered the username of the user running the backdoor.

Neoichor can collect the user name from a victim's machine.

Raspberry Robin determines whether it is successfully running on a victim system by querying the running account information to determine if it is running in Session 0, indicating running with elevated privileges.

Diavol can collect the username from a compromised host.

RustyWater has gathered the victim machine’s username.

BlackCat can utilize `net use` commands to discover the user name on a compromised host.

VERMIN gathers the username from the victim’s machine.

Nightdoor gathers information on victim system users and usernames.

MarkiRAT can retrieve the victim’s username.

PowerShower has the ability to identify the current user on the infected host.

Kazuar gathers information on users.

DarkComet gathers the username from the victim’s machine.

CHIMNEYSWEEP has included the victim's computer name and username in C2 messages sent to actor-owned infrastructure.

Lucifer has the ability to identify the username on a compromised host.

zwShell can obtain the name of the logged-in user on the victim.

DRATzarus can obtain a list of users from an infected machine.

Rising Sun can detect the username of the infected host.

Chrommme can retrieve the username from a targeted system.

ObliqueRAT can check for blocklisted usernames on infected endpoints.

SocGholish can use `whoami` to obtain the username from a compromised host.

Flagpro has been used to run the whoami command on the system.

XAgentOSX contains the getInfoOSX function to return the OS X version as well as the current user.

ROKRAT can collect the username from a compromised host.

DarkWatchman has collected the username from a victim machine.

Dyre has the ability to identify the users on a compromised host.

PlugX has the ability to gather the username from the victim’s machine.

Reaver collects the victim's username.

S-Type has run tests to determine the privilege level of the compromised user.

Remsec can obtain information about the current user.

Explosive has collected the username from the infected host.

Epic collects the user name from the victim’s machine.

Clambling can identify the username on a compromised host.