Procedure examples

Egregor has used tools to gather information about users.

PoetRAT sent username, computer name, and the previously generated UUID in reply to a "who" command from C2.

FELIXROOT collects the username from the victim’s machine.

ZxShell can collect the owner and organization information from the target workstation.

NDiskMonitor obtains the victim username and encrypts the information to send over its C2 channel.

BabyShark has executed the whoami command.

Cannon can gather the username from the system.

CreepySnail can execute `getUsername` on compromised systems.

njRAT enumerates the current user during the initial infection.

JPIN can obtain the victim user name.

metaMain can collect the username from a compromised host.

SideTwist can collect the username on a targeted system.

MechaFlounder has the ability to identify the username and hostname on a compromised host.

Mis-Type runs tests to determine the privilege level of the compromised user.

LunarWeb can collect user information from the targeted host.

Octopus can collect the username from the victim’s machine.

STARWHALE can gather the username from an infected host.

MirageFox can gather the username from the victim’s machine.

DownPaper collects the victim username and sends it to the C2 server.

Agent Tesla can collect the username from the victim’s machine.

POWERSTATS has the ability to identify the username on the compromised host.

Goopy has the ability to enumerate the infected system's user name.

ShadowPad has collected the username of the victim system.

QakBot can identify the user name on a compromised system.

Gelsemium has the ability to distinguish between a standard user and an administrator on a compromised host.

The OsInfo function in Komplex collects the current running username.

Denis enumerates and collects the username from the victim’s machine.

Lizar can collect the username from the system.

Azorult can collect the username from the victim’s machine.

UPPERCUT has the capability to collect the current logged on user’s username from a machine.

StrifeWater can collect the user name from the victim's machine.

SLOTHFULMEDIA has collected the username from a victim machine.

XORIndex Loader has collected the username from the victim host.

Small Sieve can obtain the id of a logged in user.

BloodHound can collect information on user sessions.

SILENTTRINITY can gather a list of logged on users.

Empire can enumerate the username on targeted hosts.

AsyncRAT can check if the current user of a compromised system is an administrator.

Remcos can enumerate the username on targeted hosts.

NBTscan can list active users on the system.

Koadic can identify logged in users across the domain and views user sessions.

Pupy can enumerate local information for Linux hosts and find currently logged on users for Windows hosts.

QuasarRAT can enumerate the username and account type.

TeamPCP Cloud Stealer can use `whoami` on self-hosted runners to identify the current user.

Mini Shai-Hulud has leveraged commands such as `whoami` to identify the system owner.

CanisterWorm has parsed the /var/log/auth.log and /var/log/secure files for usernames.