Detection of System User Discovery via query.exe

The Windows binary query.exe is frequently leveraged by threat actors to perform system user discovery, a critical stage in the reconnaissance phase of an attack. By executing this utility, adversaries can enumerate currently logged-in users, mapping the environment to identify high-value targets or accounts with elevated privileges. This technique is often associated with Active Directory discovery efforts and has been documented in various campaigns, including activities related to Medusa Ransomware. While query.exe is a standard Windows component, its usage in command-line configurations targeting user information - specifically when not directed at local server contexts - serves as a high-fidelity signal for unauthorized reconnaissance. Defenders should focus on capturing full command-line arguments to distinguish between legitimate administrative troubleshooting and adversary-led discovery operations.

Impact

Successful execution of this discovery technique allows attackers to gain critical situational awareness of the compromised endpoint and the broader network environment. By identifying active users, adversaries can optimize lateral movement paths and identify accounts with the appropriate permissions to escalate privileges or deploy ransomware, ultimately increasing the speed and efficacy of a security incident.

Recommendation

• Deploy the provided Sigma rule to monitor for query.exe executions that include user enumeration parameters.
• Establish a baseline for administrative use of query.exe within your environment to tune out false positives originating from authorized IT management activities.
• Ensure EDR agents are configured to log full command-line strings and parent process information, as this metadata is essential for validating the intent behind query.exe execution.