Rule Info
Tags
attack.discovery car.2016-03-001 attack.t1033 DEMO
Modified
None
Author
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Name
Suspicious Whoami.EXE Execution
Description
Detects the execution of "whoami.exe" with the "/all" flag or with redirection options to export the results to a file for later use.
Date
2023-02-28 00:00:00
Id
c30fb093-1109-4dc8-88a8-b30d11c95a5d
Type
Community Rule
Link to Public Repo
Rule History
Commit
Date
Author
Title
Scan your endpoints, forensic images or collected files with our portable scanner THOR