Whoami.EXE Execution Anomaly with Suspicious Parent Process

SigmaHQ Detections@sigmaHQ

•updated Apr 7, 2025•0•14

Detects the execution of 'whoami.exe' when its parent process is not a common legitimate shell or application, or when the parent process information is missing. This can indicate suspicious activity, as 'whoami.exe' is often used by attackers for discovery purposes.