Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
332 detections
Filters
Last updated
All Time
Detection languages
121
113
37
21
15
Contributors
58
49
41
33
23
Categories
241
229
38
28
19
Platforms
280
52
10
7
4
Products / Services
86
68
67
27
25
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
6
6
2
2
2
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
Detects the use of the PowerShell Get-ADUser cmdlet to enumerate Active Directory user information and export it to a file or pipe it to other cmdlets for further processing, which can be indicative of reconnaissance or data staging by an attacker.
Detects the execution of 'whoami.exe' with the '/groups' or '-groups' command-line flag to enumerate group membership for the current user. This activity is often performed by attackers during the discovery phase to understand the privileges of a compromised account.
Detects the execution of 'whoami.exe' with the '/priv' or '-priv' command-line flag. This command is used to display the current user's security privileges and is often executed by adversaries after a successful privilege escalation to understand their new capabilities or during discovery phases.
Detects the use of the Get-ADComputer PowerShell cmdlet to enumerate computer information within an Active Directory environment and export the results to a file. This activity is often performed by adversaries during the discovery phase to map out the network.
This rule detects the execution of the 'whoami.exe' utility when its executable file name has been changed from the original 'whoami.exe'. Adversaries often rename legitimate system utilities to evade detection by security tools that monitor for specific process names. This technique is commonly used during the discovery phase to gather information about the compromised system's user context without triggering alerts associated with the standard 'whoami.exe' process name.
Cisco Discovery
Sigma
Find information about network devices that is not stored in config files
Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file
Detects the execution of whoami that has been renamed to a different name to avoid detection
WhoAmI as Parameter
Sigma
Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file
Detects the use of PowerShell to identify the current logged user.
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file
Detects the execution of whoami.exe with the /group command line flag to show group membership for the current user, account type, security identifiers (SID), and attributes.
Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privileges. This is often used after a privilege escalation attempt.
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
Page 16 of 16