Description
JuicyPotato is an open source local privilege escalation tool that abuses Windows service accounts to gain SYSTEM privileges. It is a refined version of the RottenPotatoNG technique, and while penetration testers use it legitimately, cyberattackers commonly run it after gaining a foothold to escalate privileges on compromised servers.
Stats
- First seen
- October 2022
- Last seen
- September 2026
Alert name variants
| Alert Name |
|---|
| Gen:Variant.Exploit.JuicyPotato.2 |
| Win32.Backdoor.JuicyPotato |
| Win64.Backdoor.JuicyPotato |
| Win64.Hacktool.JuicyPotato |
| Win64.Trojan.JuicyPotato |