Windows System User Discovery via Quser

The Windows utility quser.exe is frequently abused by attackers during the post-exploitation phase to gather information about active user sessions on a system or Remote Desktop Session Host. This technique is categorized under system user discovery and is commonly implemented by automated privilege escalation and post-exploitation tools, such as winPEAS. By enumerating active sessions, attackers identify high-value accounts or existing administrative sessions to facilitate further compromise, privilege escalation, or lateral movement. This behavior has been observed in various attack campaigns, including the deployment of Prestige ransomware. Defenders should monitor for the execution of this utility, particularly when initiated by suspicious parent processes or in environments where the tool is not required for daily administration.

Impact

Successful user discovery allows attackers to map the environment, identify target accounts for credential harvesting, and determine the reach of current session access. This reconnaissance is a critical prerequisite for lateral movement and the subsequent deployment of ransomware or other destructive payloads.

Recommendation

• Deploy the provided Sigma rule to monitor for execution of quser.exe via endpoint process creation logs.
• Establish a baseline of legitimate quser.exe usage by network and systems administrators to reduce false positives.
• Correlate quser.exe execution with other post-exploitation indicators, such as the use of winPEAS or unexpected network connections.