Procedure examples

Milan can identify users registered to a targeted machine.

OilBooster can identify the compromised system's username which is then used as part of a unique identifier.

Raccoon Stealer gathers information on the infected system owner and user.

Cardinal RAT can collect the username from a victim machine.

BISCUIT has a command to gather the username from the system.

Gold Dragon collects the endpoint victim's username and uses it as a basis for downloading additional components from the C2 server.

RGDoor executes the whoami on the victim’s machine.

Revenge RAT gathers the username from the system.

MacMa can collect the username from the compromised machine.

FunnyDream has the ability to gather user information from the targeted system using `whoami/upn&whoami/fqdn&whoami/logonid&whoami/all`.

More_eggs has the capability to gather the username from the victim's machine.

SysUpdate can collect the username from a compromised host.

Kwampirs collects registered owner details by using the commands systeminfo and net config workstation.

BoomBox can enumerate the username on a compromised host.

LAMEHUG can use `whoami` to enumerate the system user.

Mango can collect the user name from a compromised system which is used to create a unique victim identifier.

GrimAgent can identify the user id on a target machine.

Lokibot has the ability to discover the username on the infected host.

Egregor has used tools to gather information about users.

PoetRAT sent username, computer name, and the previously generated UUID in reply to a "who" command from C2.

FELIXROOT collects the username from the victim’s machine.

ZxShell can collect the owner and organization information from the target workstation.

NDiskMonitor obtains the victim username and encrypts the information to send over its C2 channel.

BabyShark has executed the whoami command.

Cannon can gather the username from the system.

CreepySnail can execute `getUsername` on compromised systems.

njRAT enumerates the current user during the initial infection.

JPIN can obtain the victim user name.

metaMain can collect the username from a compromised host.

SideTwist can collect the username on a targeted system.

MechaFlounder has the ability to identify the username and hostname on a compromised host.

Mis-Type runs tests to determine the privilege level of the compromised user.

LunarWeb can collect user information from the targeted host.

Octopus can collect the username from the victim’s machine.

STARWHALE can gather the username from an infected host.

MirageFox can gather the username from the victim’s machine.

DownPaper collects the victim username and sends it to the C2 server.

Agent Tesla can collect the username from the victim’s machine.

POWERSTATS has the ability to identify the username on the compromised host.

Goopy has the ability to enumerate the infected system's user name.

ShadowPad has collected the username of the victim system.

QakBot can identify the user name on a compromised system.

Gelsemium has the ability to distinguish between a standard user and an administrator on a compromised host.

The OsInfo function in Komplex collects the current running username.

Denis enumerates and collects the username from the victim’s machine.

Lizar can collect the username from the system.

Azorult can collect the username from the victim’s machine.

UPPERCUT has the capability to collect the current logged on user’s username from a machine.

StrifeWater can collect the user name from the victim's machine.

SLOTHFULMEDIA has collected the username from a victim machine.