Skip to content
Threat Feed

Vendor

Cohesity

1 brief RSS
low advisory

Suspicious Whoami Process Activity

This rule detects suspicious use of whoami.exe to display user, group, and privileges information for the user who is currently logged on to the local system, potentially indicating post-compromise discovery activity.

Microsoft Monitoring Agent +1 discovery windows threat-detection
2r 2t