Base64 Encoded Whoami Execution

Kaung Khant Ko@kaungkhantko

•updated Jun 9, 2026•5•0•12

Detects the execution of the 'whoami' command when its base64 encoded string ('d2hvYW1p') appears in a process command line. This pattern is often associated with web shells or other malicious activity attempting to gain system information.