whoami.exe

whoami.exe prints information from the current process's access token. With no arguments it shows the domain and user name. /groups lists the groups in the token, /priv lists the privileges and whether each is enabled, and /all dumps everything, user, SID, groups, and privileges, at once. The genuine binary lives at C:\Windows\System32\whoami.exe.

Legitimately, whoami appears in logon scripts and interactive admin sessions to confirm which account or privilege level a shell is running under. It only reads token information and changes nothing.

whoami is a staple of the first moments after access (T1033). An attacker who lands in a shell runs it to see whose account they hold and, with /priv, whether that token already carries powerful privileges like SeDebugPrivilege or SeImpersonatePrivilege that open a path to escalation. /groups and /all reveal the group memberships that map out what the account can reach (T1069.001).

The command is harmless by itself. What matters is the company it keeps: a whoami launched by a web server or an Office process, or as the first of several discovery commands in quick succession, reads as hands-on-keyboard reconnaissance rather than administration.