Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
327 detections
Filters
Last updated
All Time
Detection languages
116
113
37
21
15
Contributors
58
49
41
33
23
Categories
236
224
38
28
19
Platforms
275
47
7
5
4
Products / Services
86
67
63
27
25
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
6
6
2
2
2
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
Cisco Discovery
Sigma
Find information about network devices that is not stored in config files
Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file
Detects the execution of whoami that has been renamed to a different name to avoid detection
WhoAmI as Parameter
Sigma
Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file
Detects the use of PowerShell to identify the current logged user.
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file
Detects the execution of whoami.exe with the /group command line flag to show group membership for the current user, account type, security identifiers (SID), and attributes.
Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privileges. This is often used after a privilege escalation attempt.
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
Page 16 of 16