Windows whoami.exe Renamed Execution via Mismatched OriginalFileName

title: Windows whoami.exe Renamed Execution via Mismatched OriginalFileName
id: 5f0ef87f-d7de-4ed9-b13b-e36179de9aab
status: test
description: This rule flags Windows process creation events where the process metadata still indicates OriginalFileName as whoami.exe, but the executed image path ends with a different filename. Renaming built-in reconnaissance utilities like whoami can help attackers evade name-based detections and blend in with other tools. It relies on Windows process creation telemetry that includes both OriginalFileName and the Image path for the spawned process.
references:
  - https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/
  - https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_whoami.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-08-12
modified: 2022-10-09
tags:
  - attack.discovery
  - attack.t1033
  - car.2016-03-001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    OriginalFileName: whoami.exe
  filter:
    Image|endswith: \whoami.exe
  condition: selection and not filter
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: f1086bf7-a0c4-4a37-9102-01e573caf4a0
    type: derived