Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0093 — Behavioral Detection of User Discovery via Local and Remote Enumeration
DET0093

Behavioral Detection of User Discovery via Local and Remote Enumeration

4 analytic(s) · 1 technique(s) detected

Analytics

4
AN0254 Analytic 0254
Windows

Adversary launches built-in system tools (e.g., whoami, query user, net user) or scripts that enumerate user account information via local execution or remote API queries (e.g., WMI, PowerShell).

WinEventLog:Sysmon EventCode=1 WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106
[ParentProcessContext] Identify if enumeration originates from non-interactive shell or system service
[TimeWindow] Tune temporal grouping of enumeration + lateral movement attempts
[UserContext] Flag unexpected users issuing enumeration commands (e.g., service accounts)
AN0255 Analytic 0255
Linux

Adversary runs commands like `whoami`, `id`, `w`, or `cat /etc/passwd` from non-interactive or scripting contexts to enumerate system user details.

auditd:SYSCALL execve
[CommandLineRegex] Tune detection based on argument presence (e.g., `cat /etc/passwd` vs. `cat` alone)
[ShellContext] Identify if command issued via cron, systemd, or reverse shell
[AccessFrequency] Define how often user/account commands are expected on endpoint
AN0256 Analytic 0256
macOS

Adversary uses `dscl`, `who`, or environment variables like `$USER` to identify accounts or sessions via Terminal or malicious LaunchAgents.

macos:unifiedlog subsystem:com.apple.Terminal macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC
[LaunchAgentPersistence] Correlate dscl usage with known persistence vectors
[CommandExecutionPath] Distinguish between user-initiated terminal vs. script execution
[UsernameEnumerationPattern] Regex-based pattern tuning for `dscl . -list /Users` + grep filters
AN0257 Analytic 0257
Network Devices

Adversary executes CLI commands like `show users`, `show ssh`, or attempts to dump AAA user lists from routers or switches.

networkdevice:syslog aaa privilege_exec networkdevice:syslog eventlog
[CLICommandBaseline] Expected command set per device role/user role combination
[DeviceRoleSensitivity] Correlate access with core vs. edge vs. management plane sensitivity
[CommandFrequencyThreshold] Detect burst usage of `show` or `debug` commands by non-admin users

Detected Techniques

1

Details

MITRE ID
DET0093
STIX ID
x-mitre-detection-strategy--050d236f-745a-4801-add6-50cb58248615
Analytics
4
Techniques Detected
1
By Tactic
Discovery
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.