Renamed Whoami Execution (f1086bf7-a0c4-4a37-9102-01e573caf4a0)
Detects the execution of whoami that has been renamed to a different name to avoid detection
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Renamed Whoami Execution (f1086bf7-a0c4-4a37-9102-01e573caf4a0) | Sigma-Rules | System Owner/User Discovery - T1033 (03d7999c-1f4c-42cc-8373-e7690d318104) | Attack Pattern | 1 |