huntrule

Malicious JuicyPotatoNG Privilege Escalation Tool Execution from Public Directory (via process_creation)

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-22
Updated
2026-09-22
AnalysisDetection

ATT&CK techniques

Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects execution of the JuicyPotatoNG privilege escalation tool, including from the world-writable C users Public directory used as a drop location in the Telerik exploitation intrusion. The attacker stages tooling such as JuicyPotatoNG and helper batch scripts in Public before abusing token privileges to elevate. Presence of this named tool indicates hands-on privilege escalation activity.

Reporting behind it

Related detections9 linkedT1068 — drag to rearrange
Malicious Print Spooler Child Process Execution via PrintNightmare (via process_creation)
Suspicious Modification of etc passwd Following Linux Kernel Exploit
Possible AF_ALG Privilege Escalation via algif_aead Module Load
Malicious JuicyPotato Privilege Escalation Execution (UAT-7237)
Suspicious Dell ControlVault DLL Load by Unexpected Process (ReVault)
Malicious Known Vulnerable Driver Load for BYOVD Attack
Suspicious Vulnerable ASUS AsIO3.sys Driver Load
Malicious Qilin EDR Killer BYOVD Driver Load
Malicious Looney Tunables Privilege Escalation Exploit by Kinsing (via process_creation)
Malicious JuicyPotatoNG Privilege Escalation Tool Execution from Public Directory (via process_creation)
Pivot detection · T1068 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.