Detects the execution of whoami that has been renamed to a different name to avoid detection
Read the full analysis on IntelFusions