TACTIC: DISCOVERY
System Owner/User Discovery (T1033): Real Cases
MITRE Definition ↗ Adversaries identify the primary user or logged-on account on compromised hosts.
Key Facts
Technique ID
T1033
Discovery
Mapped Cases
1
Primary sources
Related Laws
1
Criminal statutes
- ATT&CK Technique Identifier: T1033.
- Tactical Phase: Discovery.
- Substantiated in 1 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (1)
Volt Typhoon Critical Infrastructure Pre-Positioning
alleged 2023-05-24
State-sponsored cyber group sponsored by the People's Republic of China breached dozens of U.S. critical infrastructure operators in communications, energy, transportation, and water systems to establish disruptive persistent access.
Primary Source Evidence Excerpt: CISA Technical Appendix
"The threat group ran 'whoami' and 'net user' commands immediately upon authenticating to establish active privilege scope."
Federal Law Enforcement Action / FISA Court Authorized Operations · CISA-AA24-038A
View full case dossier →