Known Privilege Escalation Tool Execution

nomit vyas@xoxo

•updated Jun 25, 2026•0•0•5

Detects the execution of known Windows privilege escalation tools commonly referred to as 'potato' exploits (e.g., JuicyPotato, SweetPotato, PrintSpoofer). These tools typically exploit service account misconfigurations or Windows APIs to achieve local privilege escalation to SYSTEM.