CoercedPotato Named Pipe Creation
Detects the creation of a named pipe with the pattern '\coerced\' which is indicative of the hack tool CoercedPotato. This tool is used for privilege escalation by coercing authentication from a target system.
Sigma
Detects the creation of a named pipe with the pattern '\coerced\' which is indicative of the hack tool CoercedPotato. This tool is used for privilege escalation by coercing authentication from a target system.
Already have an account?