Windows Process Execution of SMB/NTLM Relay and Potato Attack Tools

title: Windows Process Execution of SMB/NTLM Relay and Potato Attack Tools
id: 9f404921-2d22-483c-bf5e-16a6cac078d7
status: test
description: This rule flags Windows process creation where the executable name or command line contains known indicators for SMB/NTLM relay tooling and related “Potato” privilege escalation utilities. Such tooling is frequently used by attackers to obtain elevated privileges by relaying authentication or abusing service/account token behavior. The detection relies on process creation telemetry, matching specific substrings in the process image path and command line, while excluding a small set of known benign “HotPotatoes” binaries.
references:
  - https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/
  - https://pentestlab.blog/2017/04/13/hot-potato/
  - https://github.com/ohpe/juicy-potato
  - https://hunter2.gitbook.io/darthsidious/other/war-stories/domain-admin-in-30-minutes
  - https://hunter2.gitbook.io/darthsidious/execution/responder-with-ntlm-relay-and-empire
  - https://www.localpotato.com/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_relay_attacks_tools.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-07-24
modified: 2023-02-14
tags:
  - attack.collection
  - attack.execution
  - attack.credential-access
  - attack.t1557.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_pe:
    Image|contains:
      - PetitPotam
      - RottenPotato
      - HotPotato
      - JuicyPotato
      - \just_dce_
      - Juicy Potato
      - \temp\rot.exe
      - \Potato.exe
      - \SpoolSample.exe
      - \Responder.exe
      - \smbrelayx
      - \ntlmrelayx
      - \LocalPotato
  selection_script:
    CommandLine|contains:
      - Invoke-Tater
      - " smbrelay"
      - " ntlmrelay"
      - "cme smb "
      - " /ntlm:NTLMhash "
      - Invoke-PetitPotam
      - ".exe -t * -p "
  selection_juicypotato_enum:
    CommandLine|contains: .exe -c "{
    CommandLine|endswith: '}" -z'
  filter_hotpotatoes:
    Image|contains:
      - HotPotatoes6
      - HotPotatoes7
      - "HotPotatoes "
  condition: 1 of selection_* and not 1 of filter_*
falsepositives:
  - Legitimate files with these rare hacktool names
level: critical
license: DRL-1.1
related:
  - id: 5589ab4f-a767-433c-961d-c91f3f704db1
    type: derived