LocalPotato Privilege Escalation Tool Execution

SigmaHQ Detections@sigmaHQ

•updated Nov 25, 2024•0•13

Detects the execution of the LocalPotato Proof-of-Concept (POC) tool. This detection is based on specific characteristics of the executable's image name, command-line arguments, and known import hashes (IMPHASH) associated with LocalPotato. The tool is known for exploiting vulnerabilities to achieve privilege escalation.