Local Accounts and User Discovery via OS Utilities
This rule detects the use of various operating system utilities to discover local accounts, system owners, or users. It specifically looks for the execution of `whoami.exe`, `quser.exe`, `qwinsta.exe`, `wmic.exe` with 'useraccount' and 'get' in the command line, `cmdkey.exe` with the '/l' flag, `cmd.exe` executing 'dir \Users\', and `net.exe` or `net1.exe` with 'user' in the command line, while filtering out common legitimate uses of `net` and `cmd dir` commands.
Sigma
