WhoAmI as Parameter

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•1

Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)