Whoami.exe Execution with Output Redirection or CSV Format

SigmaHQ Detections@sigmaHQ

•updated Oct 1, 2024•0•16

Detects the execution of "whoami.exe" with the "/FO CSV" flag to choose CSV as output format or with redirection options (e.g., `whoami > file.txt`) to export the results to a file for later use. This activity is often observed in post-exploitation discovery phases by adversaries to gather information about the current user.