Windows Hacktool Execution Indicators for SMB/NTLM Relay and Potato-Style Privilege Escalation
Alerts on Windows execution of common SMB/NTLM relay and “Potato” privilege escalation hacktool indicators via process creation fields.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-07-24
- Updated
- 2026-07-31
ATT&CK techniques
Cred Access → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation where the executable path or name contains well-known “Potato” and NTLM/SMB relay tool identifiers. Attackers use these tools to abuse authentication and service account contexts to attempt privilege escalation following relay attempts. The detection relies on process creation telemetry, matching both Image substrings and specific command-line fragments tied to relay and “Invoke-*” execution patterns.
Reporting behind it
- foxglovesecurity.comhttps://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/
- pentestlab.bloghttps://pentestlab.blog/2017/04/13/hot-potato/
- github.comhttps://github.com/ohpe/juicy-potato
- hunter2.gitbook.iohttps://hunter2.gitbook.io/darthsidious/other/war-stories/domain-admin-in-30-minutes
- hunter2.gitbook.iohttps://hunter2.gitbook.io/darthsidious/execution/responder-with-ntlm-relay-and-empire
- localpotato.comhttps://www.localpotato.com/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_relay_attacks_tools.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Hacktool Execution Indicators for SMB/NTLM Relay and Potato-Style Privilege Escalation
id: 9f404921-2d22-483c-bf5e-16a6cac078d7
status: test
description: This rule flags Windows process creation where the executable path or name contains well-known “Potato” and NTLM/SMB relay tool identifiers. Attackers use these tools to abuse authentication and service account contexts to attempt privilege escalation following relay attempts. The detection relies on process creation telemetry, matching both Image substrings and specific command-line fragments tied to relay and “Invoke-*” execution patterns.
references:
- https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/
- https://pentestlab.blog/2017/04/13/hot-potato/
- https://github.com/ohpe/juicy-potato
- https://hunter2.gitbook.io/darthsidious/other/war-stories/domain-admin-in-30-minutes
- https://hunter2.gitbook.io/darthsidious/execution/responder-with-ntlm-relay-and-empire
- https://www.localpotato.com/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_relay_attacks_tools.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-07-24
modified: 2023-02-14
tags:
- attack.collection
- attack.execution
- attack.credential-access
- attack.t1557.001
logsource:
category: process_creation
product: windows
detection:
selection_pe:
Image|contains:
- PetitPotam
- RottenPotato
- HotPotato
- JuicyPotato
- \just_dce_
- Juicy Potato
- \temp\rot.exe
- \Potato.exe
- \SpoolSample.exe
- \Responder.exe
- \smbrelayx
- \ntlmrelayx
- \LocalPotato
selection_script:
CommandLine|contains:
- Invoke-Tater
- " smbrelay"
- " ntlmrelay"
- "cme smb "
- " /ntlm:NTLMhash "
- Invoke-PetitPotam
- ".exe -t * -p "
selection_juicypotato_enum:
CommandLine|contains: .exe -c "{
CommandLine|endswith: '}" -z'
filter_hotpotatoes:
Image|contains:
- HotPotatoes6
- HotPotatoes7
- "HotPotatoes "
condition: 1 of selection_* and not 1 of filter_*
falsepositives:
- Legitimate files with these rare hacktool names
level: critical
license: DRL-1.1
related:
- id: 5589ab4f-a767-433c-961d-c91f3f704db1
type: derived