JuicyPotato Privilege Escalation via COM Token Impersonation

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•6

Detects the execution of 'JuicyPotato', a known tool used for local privilege escalation on Windows systems by abusing the BITS service or DCOM to achieve arbitrary process execution as SYSTEM.