Back to queue

Discovery: recon binary executed -> whoami.exe

#100020WORKSTATION-01Oct 09, 2026, 08:22:27 PMSAMPLE DATA
How to read this

An alert is one thing a detection rule flagged. The severity comes from the rule's level.

The process tree shows what launched what. A normal tool launched by an unexpected parent is often the first sign of trouble.

ATT&CK maps the behaviour to a known attacker technique. The raw event on the right is the original log, with real hostnames, users and IPs replaced by placeholders.

AI triage assist

Generate a plain-English assessment: likely verdict, reasoning, ATT&CK mapping, and the next checks an L1 analyst should make. You decide what to do with it.

Fresh analysis runs in analyst mode. The public demo shows cached results only.

Key fields

Host
WORKSTATION-01
User
user01
Process
whoami.exe
Parent
cmd.exe
Event ID
1
Channel
Microsoft-Windows-Sysmon/Operational
Rule
#100020 (level 6)

Process tree

  1. cmd.exeparent
    C:\Windows\System32\cmd.exe
  2. whoami.exeprocess
    C:\Windows\System32\whoami.exe
    whoami /all

Command line

whoami /all

ATT&CK mapping

T1033System Owner/User DiscoveryDiscovery

Analyst notes

Raw event
_id:"def456"
}
id:100020
level:6
description:"Discovery: recon binary executed -> whoami.exe"
}
id:"001"
ip:"192.0.2.1"
name:"WORKSTATION-01"
}
timestamp:"2026-10-09T22:22:27.600+02:00"
}