> For the complete documentation index, see [llms.txt](https://dmcxblue.gitbook.io/red-team-notes-2-0/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/discovery/t1033-system-owner-user-directory.md).

# T1033: System Owner/User Directory

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping. The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Utilities and commands that acquire this information include whoami. In Mac and Linux, the currently logged in user can be identified with w and who.

**Example**

Will work with the whoami command for Windows and check it's different features

**Whoami /user :** Display information on the current user and SID

![](https://315180959-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRh03Vwd4nuiUi3Oje7%2F-MS07JmoQQuxFcwQr5qH%2F-MS07Snxj11HM0PR0IR8%2Fimage.png?alt=media\&token=17b602cd-d7f3-4b86-a8bb-e108732737f5)

**Whoami /fqdn:** Displays information on the fully qualified domain name on the user

![](https://315180959-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRh03Vwd4nuiUi3Oje7%2F-MS07JmoQQuxFcwQr5qH%2F-MS07TX00jOmW14lzI_e%2Fimage.png?alt=media\&token=def95d1b-91b2-4c7f-ade4-13323c0f4ca8)

**Whoami /groups:** Displays the groups the user is a part of.

![](https://315180959-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRh03Vwd4nuiUi3Oje7%2F-MS07JmoQQuxFcwQr5qH%2F-MS07UJMPkP4Aw9_fQ9j%2Fimage.png?alt=media\&token=34d4e19d-5de1-4531-8c9e-2f27feb95977)