BIOC
Informational
✕
System owner/user discovery
System owner/user discovery using bash utilities.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Discovery
- Status:
- Enabled
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: System Owner/User Discovery (T1033)
Indicator:
Process action type = execution AND target process name = whoami , users , w , who Process initiated by =~ (ba|z|fi|tc|c|k)?sh , cgo name =~ (ba|z|fi|tc|c|k)?sh , os parent name =~ (ba|z|fi|tc|c|k)?sh Host host os = linux , macos
Preventable: no