Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)
Read the full analysis on IntelFusions