Detection of System User Discovery via whoami.exe

The execution of 'whoami.exe' is a standard technique utilized by various threat actors, including those behind Rhysida Ransomware, Qakbot, and the Winter Vivern campaign, to gain situational awareness on a compromised host. By querying the system for the current user identity, attackers establish context necessary for subsequent phases of the attack lifecycle, such as determining the success of initial access or identifying accounts suitable for privilege escalation and lateral movement. Defenders should note that while this activity is often observed in malicious contexts, it is also frequently performed by administrators and power users for routine system troubleshooting, necessitating careful tuning of detection logic to minimize noise.

Impact

Successful reconnaissance via system user discovery provides attackers with the environmental knowledge required to navigate Active Directory, identify high-value targets, and select appropriate post-exploitation tools. If this activity goes undetected, it facilitates the progression of unauthorized access toward final objectives such as data exfiltration or the deployment of ransomware.

Recommendation

Deploy the provided Sigma rule to monitor for process execution of 'whoami.exe' in your SIEM. Enable process-creation logging (Sysmon Event ID 1 or Windows Security Event ID 4688) across all endpoints. Baseline the typical frequency of 'whoami' execution by administrative accounts in your environment to distinguish between benign troubleshooting and unauthorized discovery behavior.