Windows: whoami.exe Executed by Privileged Accounts

Flags execution of whoami.exe from privileged-like accounts using Windows process creation events.

FreeUnreviewedSigmahighv1

windows-whoami-exe-executed-by-privileged-accounts-79ce34ca

title: "Windows: whoami.exe Executed by Privileged Accounts"
id: e2a9c931-3772-4d95-9240-ca91342293af
related:
  - id: 80167ada-7a12-41ed-b8e9-aa47195c66a1
    type: obsolete
  - id: 79ce34ca-af29-4d0e-b832-fc1b377020db
    type: derived
status: test
description: This rule identifies process creation events where whoami.exe is executed by accounts with privileged-like identifiers (AUTHORI, AUTORI, or TrustedInstaller). Attackers commonly use whoami to confirm the current security context during discovery or privilege-escalation workflows. Detection relies on Windows process creation telemetry, matching the OriginalFileName/Image path for whoami.exe and the initiating account name pattern in the event.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
  - https://web.archive.org/web/20221019044836/https://nsudo.m2team.org/en-us/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_whoami_execution_from_high_priv_process.yml
author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Huntrule Team
date: 2022-01-28
modified: 2023-12-04
tags:
  - attack.privilege-escalation
  - attack.discovery
  - attack.t1033
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - OriginalFileName: whoami.exe
    - Image|endswith: \whoami.exe
  selection_user:
    User|contains:
      - AUTHORI
      - AUTORI
      - TrustedInstaller
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule identifies process creation events where whoami.exe is executed by accounts with privileged-like identifiers (AUTHORI, AUTORI, or TrustedInstaller). Attackers commonly use whoami to confirm the current security context during discovery or privilege-escalation workflows. Detection relies on Windows process creation telemetry, matching the OriginalFileName/Image path for whoami.exe and the initiating account name pattern in the event.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.