Whoami Command Execution
Detects the execution of the 'whoami' command, which is frequently used by attackers post-exploitation to identify the current user's credentials and privileges. This activity is a common step in reconnaissance and privilege escalation phases of an attack.
YARA-L
