{"id":"79ce34ca-af29-4d0e-b832-fc1b377020db","title":"Whoami.EXE Execution From Privileged Process","description":"Detects the execution of \"whoami.exe\" by privileged accounts that are often abused by threat actors","author":"Florian Roth (Nextron Systems), Teymur Kheirkhabarov","status":"test","level":"high","date":"2022-01-28","modified":"2023-12-04","tags":["attack.privilege-escalation","attack.discovery","attack.t1033"],"technique_ids":["T1033"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment","https://web.archive.org/web/20221019044836/https://nsudo.m2team.org/en-us/"],"source_path":"rules/windows/process_creation/proc_creation_win_whoami_execution_from_high_priv_process.yml","source_sha256":"52f8f0ec332a357e6897081b7b36cfa4ce9db1145dedc057fd9853cff345ec88","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_whoami_execution_from_high_priv_process.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Whoami.EXE Execution From Privileged Process\nid: 79ce34ca-af29-4d0e-b832-fc1b377020db\nrelated:\n    - id: 80167ada-7a12-41ed-b8e9-aa47195c66a1\n      type: obsolete\nstatus: test\ndescription: Detects the execution of \"whoami.exe\" by privileged accounts that are often abused by threat actors\nreferences:\n    - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment\n    - https://web.archive.org/web/20221019044836/https://nsudo.m2team.org/en-us/\nauthor: Florian Roth (Nextron Systems), Teymur Kheirkhabarov\ndate: 2022-01-28\nmodified: 2023-12-04\ntags:\n    - attack.privilege-escalation\n    - attack.discovery\n    - attack.t1033\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - OriginalFileName: 'whoami.exe'\n        - Image|endswith: '\\whoami.exe'\n    selection_user:\n        User|contains:\n            - 'AUTHORI'\n            - 'AUTORI'\n            - 'TrustedInstaller'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1033","id":"T1033","name":"System Owner/User Discovery","page":"techniques/enterprise/T1033/"}],"data_path":"data/detection-rules/79ce34ca-af29-4d0e-b832-fc1b377020db.json","kind":"sigma"}