JuicyPotatoNG TabTip DCOM Local Privilege Escalation

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•20

Detects the invocation of TabTip.exe via DCOM with a specific error ID, which is indicative of the JuicyPotatoNG tool being used in brute force mode for local privilege escalation. This technique leverages a DCOM vulnerability to elevate privileges.