Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
2
Platforms
2
Products / Services
1
1
MITRE Techniques
2
2
1
CVEs
71
71
64
58
49
Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples
Detects the execution of the LocalPotato Proof-of-Concept (POC) tool. This detection is based on specific characteristics of the executable's image name, command-line arguments, and known import hashes (IMPHASH) associated with LocalPotato. The tool is known for exploiting vulnerabilities to achieve privilege escalation.