Use "who" when it is the subject of its own clause. Use "whom" when it is in any other place in the sentence, like after a preposition or if it's a direct object.
A good way to figure out whether you should use "who" or "whom," is to replace the who/whom pronoun with he/him or she/her. Whichever one sounds correct is very likely to be the right one, and the rules for these pronouns is the same.