HackTool - CoercedPotato Execution

SigmaHQ Detections@sigmaHQ

•updated Oct 1, 2025•0•13

Detects the execution of CoercedPotato, a tool used for privilege escalation. The rule specifically looks for the executable name 'CoercedPotato.exe', the command-line argument '--exploitId', or specific import hashes (IMPHASH) associated with the tool. This tool leverages vulnerabilities to achieve higher privileges on a system.