HackTool - CoercedPotato Execution

Title: HackTool - CoercedPotato Execution
Status: test
Description:Detects the use of CoercedPotato, a tool for privilege escalation
References:
  -https://github.com/hackvens/CoercedPotato
  -https://blog.hackvens.fr/articles/CoercedPotato.html
Author: Florian Roth (Nextron Systems)
Date: 2023-10-11
modified:2024-11-23
Tags:

• -'attack.privilege-escalation'
• -'attack.stealth'
• -'attack.t1055'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_loader_img:
    Image|endswith: '\CoercedPotato.exe'
  selection_params:
    CommandLine|contains: ' --exploitId '
  selection_loader_imphash:
    Hashes|contains:
      -'IMPHASH=A75D7669DB6B2E107A44C4057FF7F7D6'
      -'IMPHASH=F91624350E2C678C5DCBE5E1F24E22C9'
      -'IMPHASH=14C81850A079A87E83D50CA41C709A15'

  condition:1 of selection_*
Falsepositives:
  -Unknown
Level: high