CmdID

CmdID / Commands

whoami

The whoami command shows information about the user, groups, and privileges for the account currently logged on to the local system. Windows commands reference

On Windows, Linux 22 Sigma rules name it File whoami.exe

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0

The whoami command shows information about the user, groups, and privileges for the account currently logged on to the local system. When run without any parameters, whoami returns the current domain and user name.

whoami [/upn | /fqdn | /logonid]
whoami {[/user] [/groups] [/claims] [/priv]} [/fo <format>] [/nh]
whoami /all [/fo <format>] [/nh]

To display the domain and user name of the person who is currently logged on to this computer, type

whoamiIdentify

Trips 1 Sigma rule: lowLocal Accounts Discovery by Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community

To display all of the information in the current access token, type

whoami /allIdentify
/allDisplays all information in the current access token, including the current user name, security identifiers (SID), privileges, and groups that the current user belongs to. Windows commands reference

Trips 2 Sigma rules: mediumEnumerate All Information With Whoami.EXE by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems); lowLocal Accounts Discovery by Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community

/upnDisplays the user name in user principal name (UPN) format.
/fqdnDisplays the user name in fully qualified domain name (FQDN) format.
/logonidDisplays the logon ID of the current user.
/userDisplays the current domain and user name and the security identifier (SID).
/groupsDisplays the user groups to which the current user belongs.
/claimsDisplays the claims for current user, such as claim name, flags, type and values.
/privDisplays the security privileges of the current user.
/fo <format>Specifies the output format. Valid values include: - table - Displays output in a table. This is the default value. - list - Displays output in a list. - csv - Displays output in comma-separated value (CSV) format.
/allDisplays all information in the current access token, including the current user name, security identifiers (SID), privileges, and groups that the current user belongs to.
/nhSpecifies that the column header shouldn't be displayed in the output. This is valid only for table and CSV formats.
/?Displays help at the command prompt.

Linux

from the toybox, 0BSD

Print the current user name.

whoami

Several platforms

from tldr-pages, CC BY 4.0

This command is an alias of id --user --name.

Windows

from tldr-pages, CC BY 4.0

Display details about the current user.

Display the username of the current user

whoamiIdentify

Trips 1 Sigma rule: lowLocal Accounts Discovery by Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community

Display the groups that the current user is a member of

whoami /groupsIdentify
/groupsDisplays the user groups to which the current user belongs. Windows commands reference

Trips 2 Sigma rules: mediumGroup Membership Reconnaissance Via Whoami.EXE by Nasreddine Bencherchali (Nextron Systems); lowLocal Accounts Discovery by Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community

Display the privileges of the current user

whoami /privIdentify
/privDisplays the security privileges of the current user. Windows commands reference

Trips 2 Sigma rules: highSecurity Privileges Enumeration Via Whoami.EXE by Florian Roth (Nextron Systems); lowLocal Accounts Discovery by Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community

Display the user principal name (UPN) of the current user

whoami /upnIdentify
/upnDisplays the user name in user principal name (UPN) format. Windows commands reference

Trips 1 Sigma rule: lowLocal Accounts Discovery by Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community

Display the logon ID of the current user

whoami /logonidIdentify
/logonidDisplays the logon ID of the current user. Windows commands reference

Trips 1 Sigma rule: lowLocal Accounts Discovery by Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community

Display all information for the current user

whoami /allIdentify
/allDisplays all information in the current access token, including the current user name, security identifiers (SID), privileges, and groups that the current user belongs to. Windows commands reference

Trips 2 Sigma rules: mediumEnumerate All Information With Whoami.EXE by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems); lowLocal Accounts Discovery by Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community

What detects it

Sigma process creation rules that name whoami
criticalPotential Dridex ActivityFlorian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems)
criticalRenamed Whoami ExecutionFlorian Roth (Nextron Systems)
criticalSuspicious Child Process Of Veeam DabataseNasreddine Bencherchali (Nextron Systems)
highLinux Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
highLinux Webshell IndicatorsFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
highPotential Process Injection Via Msra.EXEAlexander McDonald
highSecurity Privileges Enumeration Via Whoami.EXEFlorian Roth (Nextron Systems)
highSuspicious Child Process Of Manage Engine ServiceDeskFlorian Roth (Nextron Systems)
highSuspicious Child Process Of Wermgr.EXEFlorian Roth (Nextron Systems)
highSuspicious Processes Spawned by Java.EXEAndreas Hunkeler (@Karneades), Florian Roth
highSuspicious Processes Spawned by WinRMAndreas Hunkeler (@Karneades), Markus Neis
highSuspicious Shells Spawn by Java Utility KeytoolAndreas Hunkeler (@Karneades)
highSuspicious Spool Service Child ProcessJustin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)
highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson
highWhoami.EXE Execution From Privileged ProcessFlorian Roth (Nextron Systems), Teymur Kheirkhabarov
highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
mediumEnumerate All Information With Whoami.EXEFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
mediumGroup Membership Reconnaissance Via Whoami.EXENasreddine Bencherchali (Nextron Systems)
mediumSuspicious Electron Application Child ProcessesNasreddine Bencherchali (Nextron Systems)
mediumWhoami.EXE Execution AnomalyFlorian Roth (Nextron Systems)
mediumWhoami.EXE Execution With Output OptionFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
lowLocal Accounts DiscoveryTimur Zinniatullin, Daniil Yugoslavskiy, oscd.community