Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
327 detections
Filters
Last updated
All Time
Detection languages
116
113
37
21
15
Contributors
58
49
41
33
23
Categories
236
224
38
28
19
Platforms
275
47
7
5
4
Products / Services
86
67
63
27
25
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
6
6
2
2
2
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
Detects the execution of whoami.exe with suspicious parent processes.
Detects the execution of "whoami.exe" with the "/FO CSV" flag to choose CSV as output format or with redirection options (e.g., `whoami > file.txt`) to export the results to a file for later use. This activity is often observed in post-exploitation discovery phases by adversaries to gather information about the current user.
Detects the execution of the 'whoami.exe' command by highly privileged accounts such as 'AUTHORITY\SYSTEM', 'NT AUTHORITY\SYSTEM', or 'TrustedInstaller'. This activity can indicate an attacker performing discovery after achieving privilege escalation, as these accounts are often targeted for abuse.
Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors
Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to export the results to a file for later use.
This rule detects suspicious sub-processes spawned by common web server processes on Linux systems. It specifically looks for web server processes (Apache, Nginx, Lighttpd, Node, Caddy, Tomcat, WebSphere) executing common system utilities and commands such as 'whoami', 'ifconfig', 'ip', 'uname', 'cat', 'crontab', 'hostname', 'iptables', 'netstat', 'pwd', and 'route'. This behavior is indicative of a web shell being used to execute commands on the compromised server.
This rule detects potential Dridex malware activity by identifying specific process patterns. It looks for `svchost.exe` processes with command lines indicating execution from a user's Desktop directory, which is unusual for legitimate svchost processes. It also identifies `regsvr32.exe` being spawned by `excel.exe` with specific command-line arguments often used by Dridex for DLL execution from temporary directories. Additionally, it flags anomalous child processes like `whoami.exe /all` or `net.exe view` (or `net1.exe view`) being spawned by `svchost.exe`, which could indicate discovery activities post-compromise by Dridex.
This rule detects various discovery commands commonly used on Cisco network devices. These commands are often used by adversaries to gather information about the network topology, device configuration, running processes, user sessions, and system details. The rule specifically looks for keywords associated with commands like 'dir' (file/directory listing), 'show arp' (ARP cache), 'show cdp' (Cisco Discovery Protocol neighbors), 'show clock' (system time), 'show ip interface' (IP interface configuration), 'show ip route' (routing table), 'show ip sockets' (network connections), 'show processes' (running processes), 'show ssh' (SSH sessions), 'show users' (logged-in users), and 'show version' (system information).
Detects PowerShell execution that enumerates Active Directory users with the 'DONT_REQ_PREAUTH' flag set (UserAccountControl flag 4194304). This flag indicates that the account does not require Kerberos pre-authentication, making it vulnerable to AS-REP Roasting attacks where an attacker can request a Ticket Granting Ticket (TGT) without providing credentials and then attempt to crack the hash offline.
Detects patterns indicative of the exploitation of the Serv-U CVE-2021-35211 vulnerability, specifically looking for the execution of 'whoami' in conjunction with specific file paths related to the Serv-U client. This activity has been associated with the threat group DEV-0322.
Detects the execution of SharpLdapWhoami, a tool designed to query LDAP services on a domain controller to identify the current user, similar to the 'whoami' command. The rule looks for the executable name, original filename, product name, and specific command-line arguments related to authentication methods.
Detects a suspicious process command line where 'whoami' is used as the first parameter, which can be indicative of privilege escalation techniques like those used by EfsPotato. This rule specifically looks for '.exe whoami' in the command line.
Detects the use of PowerShell commands or .NET methods to identify the current logged-in user on a Windows system. This activity is often performed by adversaries during the discovery phase to understand the environment.
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file. This activity is often seen in reconnaissance phases where attackers map out the network environment.
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file. This activity is often associated with reconnaissance phases where attackers enumerate Active Directory users for further targeting.
Detects Windows command lines that miss a space before or after the /c or /k flag when running a command using cmd.exe. This could indicate an attempt at command obfuscation or a typo. The rule specifically looks for patterns like 'cmd.exe/c', '\cmd/c', '"cmd/c', and similar for /k and /r, as well as specific commands like '/cwhoami', '/cpowershell', etc., where the space is missing. It filters out common false positives related to VS Code and specific command line endings.
Detects the use of the PowerShell Get-ADUser cmdlet to enumerate Active Directory user information and export it to a file or pipe it to other cmdlets for further processing, which can be indicative of reconnaissance or data staging by an attacker.
Detects the execution of 'whoami.exe' with the '/groups' or '-groups' command-line flag to enumerate group membership for the current user. This activity is often performed by attackers during the discovery phase to understand the privileges of a compromised account.
Detects the execution of 'whoami.exe' with the '/priv' or '-priv' command-line flag. This command is used to display the current user's security privileges and is often executed by adversaries after a successful privilege escalation to understand their new capabilities or during discovery phases.
Detects the use of the Get-ADComputer PowerShell cmdlet to enumerate computer information within an Active Directory environment and export the results to a file. This activity is often performed by adversaries during the discovery phase to map out the network.
This rule detects the execution of the 'whoami.exe' utility when its executable file name has been changed from the original 'whoami.exe'. Adversaries often rename legitimate system utilities to evade detection by security tools that monitor for specific process names. This technique is commonly used during the discovery phase to gather information about the compromised system's user context without triggering alerts associated with the standard 'whoami.exe' process name.
Page 15 of 16