T1033: System Owner/User Discovery
AI Answer
Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). The information may be collected in a number of different (Source: MITRE ATT&CK T1033)
ATT&CK Mapping
| Field | Value |
|---|---|
| Technique ID | T1033 |
| Name | System Owner/User Discovery |
| Tactic | Discovery (discovery) |
| Platforms | Linux, macOS, Network Devices, Windows |
| Sub-technique | No |
Why it matters
In the OpenTrojan knowledge graph, System Owner/User Discovery (T1033) is one of the highest-connectivity ATT&CK techniques: 244 MITRE STIX relationships reference this technique; 40 threat groups observed using it; 196 software families associated; 8 campaigns associated. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.
How attackers use it
Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1033).
Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping. The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Various utilities and commands may acquire this information, including whoami. In macOS and Linux, the currently logged in user can be identified with w and who. On macOS the dscl . list /Users | grep -v ’_’ command can also be used to enumerate user accounts. Environment variables, such as %USERNAME% and $USER, may also be used to access this information. On network devices, Network Device CLI commands such as show users and show ssh can be used to display users currently logged into the device.
Detection
Not available — MITRE ATT&CK does not currently publish a structured detection strategy for this technique in the ingested dataset.
Mitigation
Not available — no MITRE course-of-action was found for this technique in the ingested dataset.
Related Software
- TrickBot
- PowerDuke
- RCSession
- Spark
- SynAck
- Bumblebee
- Amadey
- NOKKI
- yty
- Backdoor.Oldrea
- IronWind
- Get2
Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).
Related Threat Groups
- APT38
- GALLIUM
- APT3
- Kimsuky
- Volt Typhoon
- Patchwork
- APT41
- Dragonfly
- APT32
- HAFNIUM
- MuddyWater
- Gamaredon Group
Group associations are from MITRE ATT&CK STIX relationships.
Related Campaigns
- SharePoint ToolShell Exploitation
- Frankenstein
- C0018
- Operation Digital Eye
- Operation CuckooBees
- Night Dragon
- Operation Wocao
- C0017
Campaign associations are from MITRE ATT&CK STIX relationships.
References
Source Attribution
Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review
Start Investigation
Move from reading to investigating T1033 System Owner/User Discovery. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about T1033 System Owner/User Discovery?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.