UAC Bypass via ShellExecuteEx runas Spawning Hidden Elevated cmd.exe
Detects the execution of the 'whoami' command via cmd.exe initiated with High integrity. This behavior is often associated with discovery efforts by adversaries operating with elevated privileges to identify the current user context.
Microsoft Sentinel (KQL)
