System Owner/User Discovery
Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running pr...
BY SOURCE
PROCEDURES (33)
Auto-extracted: 14 detections for process creation monitoring
Auto-extracted: 3 detections for script execution monitoring
Auto-extracted: 3 detections for child process
Auto-extracted: 3 detections for privilege
Auto-extracted: 2 detections for powershell
Auto-extracted: 2 detections for script block
Auto-extracted: 2 detections for privilege
Auto-extracted: 2 detections for remote
Auto-extracted: 2 detections for c2
Auto-extracted: 2 detections for lateral
Auto-extracted: 2 detections for persist
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for general monitoring
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for parent process
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for api
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for network connection monitoring
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for parent process
Auto-extracted: 1 detections for api
Auto-extracted: 1 detections for remote