id

Linux discovery T1033

Print user and group information. Confirms current user UID, GID, and group memberships for privilege assessment.

Binary Paths

  • /usr/bin/id
  • /bin/id

Glob Patterns

Pattern Notes
[i]d
Bracket class on first char
i[d]
Bracket class on second char
/usr/bin/id
Full absolute path — avoids matching shell builtin 'id'
/???/bin/id
Obfuscate /usr/ prefix
/???/???/id
Full path component obfuscation
/usr/*/id
Wildcard in bin directory

Pattern Tester

$

Try typing id or a full path like /usr/bin/id

YARA Rule

Auto-generated detection rule for id

      

Resources

← Previous gdb Catalog Next → mshta