JuicyPotato COM/DCOM Token Impersonation for SYSTEM Privilege Escalation

Ibrahim Saud@tektrix

•updated Jun 27, 2026•1•0•1

Detects the execution of the JuicyPotato privilege escalation tool, which exploits COM server permissions to escalate a lower-privileged account to NT AUTHORITY\SYSTEM. The rule monitors process creation events for known file names, command line patterns, and specific argument structures used by this tool.