How do you detect Potato privilege escalation attacks?

Detect Potato attacks by their two reliable artifacts. First, the coercion: PrintSpoofer creates a named pipe ending in pipe\spoolss from a process other than spoolsv.exe, visible in Sysmon Event 17 and 18, and RoguePotato produces unusual outbound TCP 135 from a server. Second, the result: a SYSTEM process whose parent runs as an IIS app-pool, SQL Server or other service account. Treat any hit as evidence the service account is already compromised, hunt for the web shell, and disable the Print Spooler where it is not needed.

Detecting Potato Attacks: JuicyPotato, PrintSpoofer and RoguePotato

The Potato family tricks a SYSTEM-level component into authenticating to a listener the attacker controls, then impersonates the resulting token (T1134.001, T1557). JuicyPotato and its relatives use DCOM, PrintSpoofer coerces the print spooler into a crafted named pipe, and RoguePotato redirects the OXID resolver. The entry point is nearly always a compromised IIS or SQL Server service account.

Signals at a Glance

Signal	Where	ATT&CK
Named pipe ending in \pipe\spoolss created by a process other than spoolsv.exe	Sysmon 17/18	T1134.001
SYSTEM process whose parent runs as a service or app-pool account	Sysmon 1, EDR	T1134.001
Service account process listening on a local port then receiving a SYSTEM DCOM or RPC callback	Sysmon 3, host firewall	T1557
Outbound TCP 135 from a server to an unfamiliar host (RoguePotato OXID redirect)	Firewall, Sysmon 3	T1557
Known tool names and arguments (PrintSpoofer -i -c, JuicyPotato -t * -c CLSID)	Sysmon 1, 4688	T1134.001

The Spooler Pipe Trick

PrintSpoofer creates a pipe whose name ends in \pipe\spoolss and coerces the print spooler into connecting to it. The genuine spooler pipe is created by spoolsv.exe and is named plain \spoolss, so the suffix match with a creator filter is a clean signal:

title: PrintSpoofer-Style Spooler Pipe Creation
logsource:
  product: windows
  category: pipe_created
detection:
  selection:
    PipeName|endswith: '\pipe\spoolss'
  filter_legit:
    Image|endswith: '\spoolsv.exe'
  condition: selection and not filter_legit
level: high
# tune/validate: requires Sysmon pipe events (17/18) in your configuration.

SYSTEM Children of Service Accounts

Every Potato variant ends the same way: a process running as SYSTEM that was started by something that was not. Web application pools, SQL Server and other service accounts have no business spawning a SYSTEM shell:

// Microsoft Defender (KQL) - SYSTEM process launched from a service-account parent
DeviceProcessEvents
| where AccountSid == "S-1-5-18"
| where InitiatingProcessAccountSid != "S-1-5-18"
| where InitiatingProcessAccountSid in ("S-1-5-19","S-1-5-20")
     or InitiatingProcessAccountSid startswith "S-1-5-82-"
     or InitiatingProcessAccountSid startswith "S-1-5-80-"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","whoami.exe","net.exe","rundll32.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName,
          FileName, ProcessCommandLine
// tune/validate: S-1-5-82 is an IIS app-pool SID and S-1-5-80 an NT SERVICE SID.

Hunt web shells first. A Potato run from w3wp.exe or sqlservr.exe means the attacker already has code execution, so the same alert should open an incident rather than a ticket.
Disable the Print Spooler on servers that do not print. That removes the PrintSpoofer coercion path entirely.
SeImpersonatePrivilege cannot be removed from service accounts without breaking them. Reduce exposure with separate low-privilege accounts per service and no co-hosting of untrusted web content.
JuicyPotato stopped working on Windows 10 1809 and Server 2019 and later because of DCOM changes, but GodPotato and similar variants cover current builds. Do not treat an OS version as a mitigation.

Vetted sources

Use the SigmaHQ pipe-creation and hacktool rules for PrintSpoofer, RoguePotato and JuicyPotato, Elastic’s prebuilt rules for privilege escalation via token impersonation, and Atomic Red Team for validation. Baseline your own environment — renamed binaries defeat name matching, so the pipe and parent-child logic are the durable parts.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

The Spooler Pipe Trick

SYSTEM Children of Service Accounts

Build Detections That Fire

Privilege Escalation Detection

Detection Hub

Token Impersonation Detection

PrintNightmare Detection