Windows whoami.exe Group Membership Reconnaissance via /groups Flag

title: Windows whoami.exe Group Membership Reconnaissance via /groups Flag
id: 2efdae51-170b-4184-a974-f95ebd6cfc74
status: test
description: This rule identifies execution of whoami.exe where the command line includes the /groups flag (including common variations like -groups). Attackers and administrators can use this to quickly enumerate the current user’s group memberships, including account type, SIDs, and related attributes. It relies on Windows process creation telemetry capturing the image name and command-line arguments.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/whoami
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_whoami_groups_discovery.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-28
tags:
  - attack.discovery
  - attack.t1033
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \whoami.exe
    - OriginalFileName: whoami.exe
  selection_cli:
    CommandLine|contains:
      - " /groups"
      - " -groups"
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: bd8b828d-0dca-48e1-8a63-8a58ecf2644f
    type: derived