Hayabusa medium test sigma

Whoami.EXE Execution With Output Option

Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to export the results to a file for later use.

View Source

Detection Logic

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection_main_img": [
    {
      "NewProcessName
| endswith": "\\whoami.exe"
    },
    {
      "OriginalFileName": "whoami.exe"
    }
  ],
  "selection_main_cli": {
    "CommandLine
| contains": [
      " /FO CSV",
      " -FO CSV"
    ]
  },
  "selection_special": {
    "CommandLine
| contains": "whoami*>"
  },
  "condition": "process_creation and (all of selection_main_* or selection_special)"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...