Suspicious Privilege Escalation Tool Execution

nomit vyas@xoxo

•updated Jun 25, 2026•0•0•1

Detects the execution of known Windows privilege escalation tools commonly used in post-exploitation scenarios, such as JuicyPotato, PrintSpoofer, and other 'Potato' variants, by monitoring for process file names associated with these utilities.