Windows Hacktool Execution Indicators for SMB/NTLM Relay and Potato-Style Privilege Escalation

ATT&CK techniques

Cred Access → Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1557.001Name Resolution Poisoning and SMB Relay
Discovery
Lateral Movement
Collection
- T1557.001Name Resolution Poisoning and SMB Relay
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation where the executable path or name contains well-known “Potato” and NTLM/SMB relay tool identifiers. Attackers use these tools to abuse authentication and service account contexts to attempt privilege escalation following relay attempts. The detection relies on process creation telemetry, matching both Image substrings and specific command-line fragments tied to relay and “Invoke-*” execution patterns.

Reporting behind it

Related detections9 linkedT1557.001 — drag to rearrange

Suspicious LLMNR and NBT-NS Poisoning Tooling via ALPHA SPIDER (via process_creation)

Masquerading Exchange Server Impersonation via PrivExchange Relay Attack (via security)

Windows Process Creation: Command-Line Kerberos Coercion Signature via DNS SPN Spoofing

Zeek DNS detects base64 credential target pattern consistent with Kerberos DNS object spoofing

Windows DNS Query with Kerberos Coercion Signature via DNS Object SPN Spoofing

Windows LPE Attempt via TabTip CLSID Using Microsoft-Windows-DistributedCOM (Event ID 10001)

Zeek DCE/RPC efs* Operations Indicative of EFS Remote Protocol Use

Windows Process Creation: ADCSPwn Command-Line Parameters Indicating ADCS Abuse

Windows WinDivert Driver Load via Image or Known IMPHASHes

Windows Hacktool Execution Indicators for SMB/NTLM Relay and Potato-Style Privilege Escalation

Pivot detection · T1557.001 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-execution-of-smb-ntlm-relay-and-potato-attack-tools-5589ab4f

title: Windows Hacktool Execution Indicators for SMB/NTLM Relay and Potato-Style Privilege Escalation
id: 9f404921-2d22-483c-bf5e-16a6cac078d7
status: test
description: This rule flags Windows process creation where the executable path or name contains well-known “Potato” and NTLM/SMB relay tool identifiers. Attackers use these tools to abuse authentication and service account contexts to attempt privilege escalation following relay attempts. The detection relies on process creation telemetry, matching both Image substrings and specific command-line fragments tied to relay and “Invoke-*” execution patterns.
references:
  - https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/
  - https://pentestlab.blog/2017/04/13/hot-potato/
  - https://github.com/ohpe/juicy-potato
  - https://hunter2.gitbook.io/darthsidious/other/war-stories/domain-admin-in-30-minutes
  - https://hunter2.gitbook.io/darthsidious/execution/responder-with-ntlm-relay-and-empire
  - https://www.localpotato.com/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_relay_attacks_tools.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-07-24
modified: 2023-02-14
tags:
  - attack.collection
  - attack.execution
  - attack.credential-access
  - attack.t1557.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_pe:
    Image|contains:
      - PetitPotam
      - RottenPotato
      - HotPotato
      - JuicyPotato
      - \just_dce_
      - Juicy Potato
      - \temp\rot.exe
      - \Potato.exe
      - \SpoolSample.exe
      - \Responder.exe
      - \smbrelayx
      - \ntlmrelayx
      - \LocalPotato
  selection_script:
    CommandLine|contains:
      - Invoke-Tater
      - " smbrelay"
      - " ntlmrelay"
      - "cme smb "
      - " /ntlm:NTLMhash "
      - Invoke-PetitPotam
      - ".exe -t * -p "
  selection_juicypotato_enum:
    CommandLine|contains: .exe -c "{
    CommandLine|endswith: '}" -z'
  filter_hotpotatoes:
    Image|contains:
      - HotPotatoes6
      - HotPotatoes7
      - "HotPotatoes "
  condition: 1 of selection_* and not 1 of filter_*
falsepositives:
  - Legitimate files with these rare hacktool names
level: critical
license: DRL-1.1
related:
  - id: 5589ab4f-a767-433c-961d-c91f3f704db1
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL