LoFP / some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools and frameworks. usage by non-engineers and ordinary users is unusual.

process where host.os.type == "windows" and event.type == "start" and process.name : "whoami.exe" and
(
  /* Suspicious parent processes */
  process.parent.name : (
    "wsmprovhost.exe", "w3wp.exe", "wmiprvse.exe", "rundll32.exe", "regsvr32.exe"
  ) or

  /* whoami execution under system privileges */
  (
    (
      (?process.Ext.token.integrity_level_name : "System" or ?winlog.event_data.IntegrityLevel : "System") or
      (
        user.domain : ("NT *", "* NT", "IIS APPPOOL") and
        user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20", "S-1-5-82-*") and
        not (?winlog.event_data.SubjectUserName : "*$" and ?winlog.event_data.SubjectUserName != null) and

        /* Sysmon will always populate user.id as S-1-5-18, leading to FPs */
        not data_stream.dataset : ("windows.sysmon_operational", "windows.sysmon")
      )
    ) and
    not (
      (
        process.parent.name : "cmd.exe" and
        ?process.parent.args : (
          "chcp 437>nul 2>&1 & C:\\WINDOWS\\System32\\whoami.exe  /groups",
          "chcp 437>nul 2>&1 & %systemroot%\\system32\\whoami /user",
          "C:\\WINDOWS\\System32\\whoami.exe /groups",
          "*WINDOWS\\system32\\config\\systemprofile*"
        )
      ) or
      (
        process.parent.executable : "C:\\Windows\\system32\\inetsrv\\appcmd.exe" and
        ?process.parent.args : "LIST"
      ) or
      (
        process.parent.executable : (
          "C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe",
          "C:\\Program Files\\Cohesity\\cohesity_windows_agent_service.exe"
        )
      )
    )
  )
)