Procedure examples

BabyShark has executed the whoami command.

Cannon can gather the username from the system.

CreepySnail can execute `getUsername` on compromised systems.

njRAT enumerates the current user during the initial infection.

JPIN can obtain the victim user name.

metaMain can collect the username from a compromised host.

SideTwist can collect the username on a targeted system.

MechaFlounder has the ability to identify the username and hostname on a compromised host.

Mis-Type runs tests to determine the privilege level of the compromised user.

LunarWeb can collect user information from the targeted host.

Octopus can collect the username from the victim’s machine.

STARWHALE can gather the username from an infected host.

MirageFox can gather the username from the victim’s machine.

DownPaper collects the victim username and sends it to the C2 server.

Agent Tesla can collect the username from the victim’s machine.

POWERSTATS has the ability to identify the username on the compromised host.

Goopy has the ability to enumerate the infected system's user name.

ShadowPad has collected the username of the victim system.

QakBot can identify the user name on a compromised system.

Gelsemium has the ability to distinguish between a standard user and an administrator on a compromised host.

The OsInfo function in Komplex collects the current running username.

Denis enumerates and collects the username from the victim’s machine.

Lizar can collect the username from the system.

Azorult can collect the username from the victim’s machine.

UPPERCUT has the capability to collect the current logged on user’s username from a machine.

StrifeWater can collect the user name from the victim's machine.

SLOTHFULMEDIA has collected the username from a victim machine.

XORIndex Loader has collected the username from the victim host.

Small Sieve can obtain the id of a logged in user.

BloodHound can collect information on user sessions.

SILENTTRINITY can gather a list of logged on users.

Empire can enumerate the username on targeted hosts.

AsyncRAT can check if the current user of a compromised system is an administrator.

Remcos can enumerate the username on targeted hosts.

NBTscan can list active users on the system.

Koadic can identify logged in users across the domain and views user sessions.

Pupy can enumerate local information for Linux hosts and find currently logged on users for Windows hosts.

QuasarRAT can enumerate the username and account type.

TeamPCP Cloud Stealer can use `whoami` on self-hosted runners to identify the current user.

Mini Shai-Hulud has leveraged commands such as `whoami` to identify the system owner.

CanisterWorm has parsed the /var/log/auth.log and /var/log/secure files for usernames.

KV Botnet Activity involves changing process filename to pr_set_mm_exe_file and process name to pr_set_name during later infection stages.

During Operation Honeybee, the threat actors modified the MaoCheng dropper so its icon appeared as a Word document.

For Operation Dust Storm, the threat actors disguised some executables as JPG files.

During C0018, AvosLocker was disguised using the victim company name as the filename.

During C0015, the threat actors named a binary file `compareForfor.jpg` to disguise it as a JPG file.

During Salesforce Data Exfiltration, threat actors used voice calls to socially engineer victims into authorizing a modified version of the Salesforce Data Loader app.

ArcaneDoor involved the use of digital certificates on adversary-controlled network infrastructure that mimicked the formatting used by legitimate Cisco ASA appliances.

menuPass has used esentutl to change file extensions to their true type that were masquerading as .txt files.

APT32 has disguised a Cobalt Strike beacon as a Flash Installer.