Windows execution of LocalPotato POC (LocalPotato.exe with specific PE/CLI traits)
Detects LocalPotato.exe process execution on Windows using image path, typical CLI parameters, and known imphash values.
FreeReviewedSigma · High · v2
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-02-14
- Updated
- 2026-07-31
What it detects
This rule identifies execution attempts of the LocalPotato Proof of Concept on Windows by matching process creation events for LocalPotato.exe alongside indicative command-line arguments. It also uses embedded PE metadata (imphash values) to reduce false positives. Attackers may use LocalPotato to attempt local privilege escalation, so correlating image path, command line, and hash metadata is key telemetry for detection.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-localpotato-exe-execution-for-local-privilege-escalation-6bd75993
title: Windows execution of LocalPotato POC (LocalPotato.exe with specific PE/CLI traits)
id: 9062e077-e7a0-495c-a627-41af62405443
status: test
description: This rule identifies execution attempts of the LocalPotato Proof of Concept on Windows by matching process creation events for LocalPotato.exe alongside indicative command-line arguments. It also uses embedded PE metadata (imphash values) to reduce false positives. Attackers may use LocalPotato to attempt local privilege escalation, so correlating image path, command line, and hash metadata is key telemetry for detection.
references:
- https://www.localpotato.com/localpotato_html/LocalPotato.html
- https://github.com/decoder-it/LocalPotato
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_localpotato.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-14
modified: 2024-11-23
tags:
- attack.privilege-escalation
- cve.2023-21746
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith: \LocalPotato.exe
selection_cli:
CommandLine|contains|all:
- .exe -i C:\
- -o Windows\
selection_hash_plain:
Hashes|contains:
- IMPHASH=E1742EE971D6549E8D4D81115F88F1FC
- IMPHASH=DD82066EFBA94D7556EF582F247C8BB5
condition: 1 of selection_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 6bd75993-9888-4f91-9404-e1e4e4e34b77
type: derived