Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
327 detections
Filters
Last updated
All Time
Detection languages
116
113
37
21
15
Contributors
58
49
41
33
23
Categories
236
224
38
28
19
Platforms
275
47
7
5
4
Products / Services
86
67
63
27
25
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
6
6
2
2
2
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file
Run Whoami as SYSTEM
Sigma
Detects a whoami.exe executed by LOCAL SYSTEM. This may be a sign of a successful local privilege escalation.
Detects potential Dridex acitvity via specific process patterns
Detects certain command line parameters often used during reconnaissance activity via web shells
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller
Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privileges. This is often used after a privilege escalation attempt.
Detects the execution of "whoami.exe" with the "/all" flag
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file
Detects the execution of whoami.exe with the /group command line flag to show group membership for the current user, account type, security identifiers (SID), and attributes.
Detects the execution of whoami, which is often used by attackers after exploitation / privilege escalation
Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to export the results to a file for later use.
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file
Detects the execution of whoami that has been renamed to a different name to avoid detection
Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privileges. This is often used after a privilege escalation attempt.
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file
Detects the execution of "whoami.exe" with the "/all" flag
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file
Detects the execution of whoami.exe with the /group command line flag to show group membership for the current user, account type, security identifiers (SID), and attributes.
Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to export the results to a file for later use.
Detects the execution of whoami.exe with suspicious parent processes.
Page 12 of 16