Windows whoami.exe Group Membership Reconnaissance via /groups Flag
Flags whoami.exe runs that use the /groups option to enumerate current user group memberships and SIDs.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-02-28
- Updated
- 2026-07-30
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies execution of whoami.exe where the command line includes the /groups flag (including common variations like -groups). Attackers and administrators can use this to quickly enumerate the current user’s group memberships, including account type, SIDs, and related attributes. It relies on Windows process creation telemetry capturing the image name and command-line arguments.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows whoami.exe Group Membership Reconnaissance via /groups Flag
id: 2efdae51-170b-4184-a974-f95ebd6cfc74
status: test
description: This rule identifies execution of whoami.exe where the command line includes the /groups flag (including common variations like -groups). Attackers and administrators can use this to quickly enumerate the current user’s group memberships, including account type, SIDs, and related attributes. It relies on Windows process creation telemetry capturing the image name and command-line arguments.
references:
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/whoami
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_whoami_groups_discovery.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-28
tags:
- attack.discovery
- attack.t1033
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \whoami.exe
- OriginalFileName: whoami.exe
selection_cli:
CommandLine|contains:
- " /groups"
- " -groups"
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: bd8b828d-0dca-48e1-8a63-8a58ecf2644f
type: derived