WhoAmI as Parameter

Title: WhoAmI as Parameter
Status: test
Description:Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)
References:
  -https://twitter.com/blackarrowsec/status/1463805700602224645?s=12
Author: Florian Roth (Nextron Systems)
Date: 2021-11-29
modified:2022-12-25
Tags:

• -'attack.discovery'
• -'attack.t1033'
• -'car.2016-03-001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains: '.exe whoami'
  condition:selection
Falsepositives:
  -Unknown
Level: high