What's suspicious about this event log?

Question

I got an event that something is wrong with, but I don't understand what exactly.

{
    "EventTime":"2021-11-22 21:05:45",
    "Hostname":"pc2",
    "Keywords":-9214364837600034816,
    "EventType":"AUDIT_SUCCESS",
    "SeverityValue":2,
    "Severity":"INFO",
    "EventID":4688,
    "SourceName":"Microsoft-Windows-Security-Auditing",
    "ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}",
    "Version":1,
    "Task":13312,
    "OpcodeValue":0,
    "RecordNumber":13215,
    "ProcessID":4,
    "ThreadID":52,
    "Channel":"Security",
    "Category":"Process Creation",
    "Opcode":"Information",
    "SubjectUserSid":"S-1-5-18",
    "SubjectUserName":"PC2$",
    "SubjectDomainName":"WORKGROUP",
    "SubjectLogonId":"0x17d73",
    "NewProcessId":"0x1330",
    "NewProcessName":"C:\\Windows\\System32\\whoami.exe",
    "TokenElevationType":"%%1936",
    "EventReceivedTime":"2021-11-22 21:09:25",
    "SourceModuleName":"eventlog",
    "SourceModuleType":"im_msvistalog"
    }

It caught my eye that EventTime and EventReceivedTime differ by almost 4 minutes, but I do not know what it means.

Answer 1

If some sort of system flagged this as suspicious, its most likely due to the execution of whoami.exe .

The execution of whoami.exe is commonly performed by threat actors to find which user account they are running as.

It is common to see alerts in SIEMs or other security systems set up to trigger upon execution of whoami.exe due to its popularity with threat actors.

This doesn't mean that it is malicious, you will want to look at other logs on that host from the same time period, but it is worth investigating if you don't see this command being run often.

In addition, the SID of the user that ran the command is associated with LocalSystem. It is unusual to see the System account running whoami