Security Privileges Enumeration Via Whoami.EXE
Attack scenariowindows:auditMITRE T1033
- By
- sigmahq
- Version
- 0.2
- Name
- sigmahq/proc_creation_win_whoami_priv_discovery
- Remediation
- Alert only
Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privileges. This is often used after a privilege escalation attempt.
Install with a top-level collection
1 collection include itsudo cscli collections install sigmahq/windows_proc_creationInstalls 1 parser and 520 scenarios.
View Windows - Suspicious Process Detection →Installation
sudo cscli scenarios install sigmahq/proc_creation_win_whoami_priv_discoveryThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
type: triggername: sigmahq/proc_creation_win_whoami_priv_discoverydescription: |Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privileges. This is often used after a privilege escalation attempt.filter: |(evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.Image endsWith '\\whoami.exe' || evt.Parsed.OriginalFileName == 'whoami.exe') && (evt.Parsed.CommandLine contains ' /priv' || evt.Parsed.CommandLine contains ' -priv'))blackhole: 2m#status: testlabels:service: windowsconfidence: 1spoofable: 0classification:- attack.t1033label: "Security Privileges Enumeration Via Whoami.EXE"behavior : "windows:audit"remediation: falsescope:type: ParentProcessIdexpression: evt.Parsed.ParentProcessId
Installed on
Know where it runs
Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.