Whoami.exe with /all Flag Execution
This rule detects the execution of the built-in Windows utility "whoami.exe" specifically when used with the "/all" flag. This command is often used by attackers during the discovery phase to gather extensive information about the current user, including user name, security identifiers (SIDs), groups, and privileges. This detailed information can help an adversary understand their current access level and plan subsequent actions.
Sigma
