Current User Discovery via Web Shell Whoami

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects attempts to discover the current user via a web shell by looking for HTTP requests containing the string "whoami" in the URI. This is a common command executed on compromised web servers to gain information about the user context of the web server process.