Enumerate All Information With Whoami.EXE — Detection Rule

Detects the execution of "whoami.exe" with the "/all" flag

Read the full analysis on IntelFusions