Hello and welcome to
another application of the moderate
tech framework discussion
today we're going to look at system
owner user discovery.
So today's objectives are as
follows. We're going to describe
system owner or user
discovery. We'll look at some
commands that are in here.
We'll talk about mitigation
techniques and detection techniques
as well.
So with that, let's go ahead and
jump right in.
System owner and user discovery
is pretty straightforward.
It's one of the threat actor
attempts to identify the primary
user logged into a system.
And then the third actor may then
use this information
to determine next steps and how to
use that individual account.
So some commands that a third
actor might use in that instance
once they've gotten into a system,
would be things like Juanma on
a Windows system.
They may use ID, dash U.N.
or W on a Mac, who
am I or W on a Linux
device.
And so really just depends on
what distribution they've gotten
themselves into or what version of
an operating system they've gotten
themselves into.
And then they will run some standard
commands to see who the user
is with their access level is and
what they can do at that point
with the account. So it's not very
high level as far as the details on
this. It's just what am I what
have I gotten myself into?
And is it a super user?
Is it just a standard maybe front
desk type account?
So some mitigation techniques here
really preventing the use of
the command line
and not allowing users to use the
command line is going to be
beneficial here. And if a user has a
reason to use the command line, then
they could have a separate account
that they could use while they need
to write scripts or do something in
that nature. And then they use a
different account for day to
day or non scripting
type activities.
Detection techniques follow along
with some of our previous
discussions, is essentially looking
at system events
and looking at activity to
determine if they amount to
a malicious threat actor or if it's
just normal day to day business
activity. Again, as
we get into some of these areas, we
get less and less dependent on tools
and more and more dependent
upon human intervention
and human
kind of knowledge with respect to
knowing how these things look and
knowing what is normal and is not
normal for a business entity.
Now, let's go ahead and jump in to
our chat on learning
true or false user discovery is any
threat actor attempts to determine
the current or primary user
of a system.
So if you need additional time,
by all means, please pass the video.
But in this instance, this
particular statement is true.
User discovery is a threat.
Actor attempts to determine the
current or primary user
of a system.
So this is a true
statement.
Now, jumping into our summary,
we looked at and described
system owner and user discovery
and why that would be important to
it through an actor is so that they
could figure out who they are,
what they can do, and then kind of
figure out their next steps.
Mitigation techniques are really
going to be preventing in users from
using the command line and thereby
hopefully mitigating a threat actor
from using some of those commands.
Detection techniques are following,
along with previous discussions
where we're really looking at
correlating activity and
determining if we have a malicious
entity on the network.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.