Whoami.EXE Execution From Privileged Process — Detection Rule
Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors
Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors