Procedure examples

BlackCat can utilize `net use` commands to discover the user name on a compromised host.

VERMIN gathers the username from the victim’s machine.

Nightdoor gathers information on victim system users and usernames.

MarkiRAT can retrieve the victim’s username.

PowerShower has the ability to identify the current user on the infected host.

Kazuar gathers information on users.

DarkComet gathers the username from the victim’s machine.

CHIMNEYSWEEP has included the victim's computer name and username in C2 messages sent to actor-owned infrastructure.

Lucifer has the ability to identify the username on a compromised host.

zwShell can obtain the name of the logged-in user on the victim.

DRATzarus can obtain a list of users from an infected machine.

Rising Sun can detect the username of the infected host.

Chrommme can retrieve the username from a targeted system.

ObliqueRAT can check for blocklisted usernames on infected endpoints.

SocGholish can use `whoami` to obtain the username from a compromised host.

Flagpro has been used to run the whoami command on the system.

XAgentOSX contains the getInfoOSX function to return the OS X version as well as the current user.

ROKRAT can collect the username from a compromised host.

DarkWatchman has collected the username from a victim machine.

Dyre has the ability to identify the users on a compromised host.

PlugX has the ability to gather the username from the victim’s machine.

Reaver collects the victim's username.

S-Type has run tests to determine the privilege level of the compromised user.

Remsec can obtain information about the current user.

Explosive has collected the username from the infected host.

Epic collects the user name from the victim’s machine.

Clambling can identify the username on a compromised host.

PureCrypter can retrieve the username from targeted machines.

NanHaiShu collects the username from the victim.

SVCReady can collect the username from an infected host.

NGLite will run the whoami command to gather system information and return this to the command and control server.

SHARPSTATS has the ability to identify the username on the compromised host.

Caterpillar WebShell can obtain a list of user accounts from a victim's machine.

Gazer obtains the current user's security identifier.

Latrodectus can discover the username of an infected host.

Saint Bot can collect the username from a compromised host.

Chaes has collected the username and UID from the infected machine.

LODEINFO can identify the associated username on targeted machines.

EVILNUM can obtain the username from the victim's machine.

SMOKEDHAM has used whoami commands to identify system owners.

QUADAGENT gathers the victim username.

Sys10 collects the account name of the logged-in user and sends it to the C2.

Metamorfo has collected the username from the victim's machine.

Trojan.Karagany can gather information about the user on a compromised host.

KONNI can collect the username from the victim’s machine.

T9000 gathers and beacons the username of the logged in account during installation. It will also gather the username of running processes to determine if it is running as SYSTEM.

DnsSystem can use the Windows user name to create a unique identification for infected users and systems.

BLUELIGHT can collect the username on a compromised host.

Ixeshe collects the username from the victim’s machine.

Micropsia collects the username from the victim’s machine.