Whoami.EXE Execution Anomaly

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection": [
    {
      "NewProcessName
| endswith": "\\whoami.exe"
    },
    {
      "OriginalFileName": "whoami.exe"
    }
  ],
  "filter_main_known_parents": {
    "ParentProcessName
| endswith": [
      "\\cmd.exe",
      "\\powershell_ise.exe",
      "\\powershell.exe",
      "\\pwsh.exe"
    ]
  },
  "filter_optional_ms_monitoring_agent": {
    "ParentProcessName
| endswith": ":\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe"
  },
  "filter_main_parent_null": {
    "ParentProcessName": null
  },
  "filter_main_parent_empty": {
    "ParentProcessName": [
      "",
      "-"
    ]
  },
  "condition": "process_creation and (selection and not 1 of filter_main_* and not 1 of filter_optional_*)"
}

False Positives

• ⚠ Admin activity
• ⚠ Scripts and administrative tools used in the monitored environment
• ⚠ Monitoring activity