Run Whoami as SYSTEM

Detects a whoami.exe executed by LOCAL SYSTEM. This may be a sign of a successful local privilege escalation.