Date: 11/26/2024
Severity: High
Summary
Detects the use of CoercedPotato, a tool designed for privilege escalation.
Indicators of Compromise (IOC) List
Image : | '\CoercedPotato.exe' |
CommandLine : | ' --exploitId ' |
Hashes : |
'IMPHASH=A75D7669DB6B2E107A44C4057FF7F7D6'
'IMPHASH=F91624350E2C678C5DCBE5E1F24E22C9'
'IMPHASH=14C81850A079A87E83D50CA41C709A15' |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1: | (resourcename = "Windows Security" AND eventtype = "4688" ) AND ((processname like "CoercedPotato.exe" OR newprocessname like "CoercedPotato.exe" ) OR commandline like "--exploitId") |
Detection Query 2: | (technologygroup = "EDR" ) AND ((processname like "CoercedPotato.exe" OR newprocessname like "CoercedPotato.exe" ) OR commandline like "--exploitId") |
Detection Query 3: |
md5hash IN ("A75D7669DB6B2E107A44C4057FF7F7D6","F91624350E2C678C5DCBE5E1F24E22C9","14C81850A079A87E83D50CA41C709A15") |
Reference:
https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_coercedpotato.yml