Base64 Encoded Whoami Command Execution

nomit vyas@xoxo

•updated Jun 22, 2026•1•0•12

Detects the execution of the 'whoami' command when it is base64 encoded in the process command line. This technique is often used by adversaries to discover system user information while attempting to evade simple string-based detections.