Whoami.EXE Execution Anomaly (8de1cbe8-d6f5-496d-8237-5f44a721c7a0)
Detects the execution of whoami.exe with suspicious parent processes.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| System Owner/User Discovery - T1033 (03d7999c-1f4c-42cc-8373-e7690d318104) | Attack Pattern | Whoami.EXE Execution Anomaly (8de1cbe8-d6f5-496d-8237-5f44a721c7a0) | Sigma-Rules | 1 |