whoami command used by attackers

Often, attackers will execute “whoami”, “id”, or other similar commands shortly after achieving RCE to determine the access level in which they are able to operate.

This can be used for detection of malicious activity.

---