T1033 System Owner Discovery via whoami.exe from Suspicious Parent

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

Detects the execution of the 'whoami' utility with flags that enumerate user privileges or information ('/all', '/priv'), when initiated by command-line interpreters like cmd.exe, powershell.exe, wscript.exe, cscript.exe, or mshta.exe. This behavior is commonly associated with attackers performing discovery after gaining a foothold on a system.