Detectionmediumtest

Enumerate All Information With Whoami.EXE

Detects the execution of "whoami.exe" with the "/all" flag

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)Created Mon Dec 04Updated Tue Mar 05c248c896-e412-4279-8c15-1c558067b6fawindows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_main_img:
        - Image|endswith: '\whoami.exe'
        - OriginalFileName: 'whoami.exe'
    selection_main_cli:
        CommandLine|contains|windash: ' -all'
    condition: all of selection_main_*

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0007 · Discovery

Techniques

T1033 · System Owner/User Discovery

CAR Analytics

2016-03-001 · CAR 2016-03-001

Rule Metadata

Rule ID

c248c896-e412-4279-8c15-1c558067b6fa

Status

test

Level

medium

Type

Detection

Created

Mon Dec 04

Modified

Tue Mar 05

Author

Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

Path

rules/windows/process_creation/proc_creation_win_whoami_all_execution.yml

Raw Tags

attack.discoveryattack.t1033car.2016-03-001

View on GitHub