Techniques
Sample rules
User Discovery via Whoami
- source: elastic
- technicques:
- T1033
Description
The whoami application was executed on a Linux host. This is often used by tools and persistence mechanisms to test for privileged access.
Detection logic
event.category:process and event.type:(start or process_started) and process.name:whoami