Linux System Owner or User Discovery Commands

SigmaHQ Detections@sigmaHQ

•updated Jun 5, 2025•2•0•19

Detects the execution of host or user discovery utilities such as "whoami", "hostname", "id", "last", "uname", "users", "w", and "who" on Linux systems. Adversaries use these commands to gather information about the system and its users to inform subsequent actions.