Potato-Family Token Impersonation Tool Execution Detected
Detects the execution of known Windows privilege escalation tools (often referred to as 'Potato' exploits) which leverage various Windows service vulnerabilities or print spooler manipulation to escalate user privileges to SYSTEM level.
Microsoft Sentinel (KQL)
