Detectioncriticaltest

Renamed Whoami Execution

Detects the execution of whoami that has been renamed to a different name to avoid detection

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems)Created Thu Aug 12Updated Sun Oct 09f1086bf7-a0c4-4a37-9102-01e573caf4a0windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        OriginalFileName: 'whoami.exe'
    filter:
        Image|endswith: '\whoami.exe'
    condition: selection and not filter

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0007 · Discovery

Techniques

T1033 · System Owner/User Discovery

CAR Analytics

2016-03-001 · CAR 2016-03-001

Rule Metadata

Rule ID

f1086bf7-a0c4-4a37-9102-01e573caf4a0

Status

test

Level

critical

Type

Detection

Created

Thu Aug 12

Modified

Sun Oct 09

Author

Florian Roth (Nextron Systems)

Path

rules/windows/process_creation/proc_creation_win_renamed_whoami.yml

Raw Tags

attack.discoveryattack.t1033car.2016-03-001

View on GitHub