Sigma rule: Detection of Possible Rotten Potato

Rule

Title

Detection of Possible Rotten Potato

Status

unsupported

Level

high

Author

Teymur Kheirkhabarov

Date

2019/10/26

Modified

2020/09/01

File

unsupported/windows/win_possible_privilege_escalation_using_rotten_potato.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE privileges

Log source

product

windows

category

process_creation

definition

Works only if Enrich Sysmon events with additional information about process in ParentUser check enrichment section

Detection

selection:
    ParentUser:
        - 'NT AUTHORITY\NETWORK SERVICE'
        - 'NT AUTHORITY\LOCAL SERVICE'
    User: 'NT AUTHORITY\SYSTEM'
rundllexception:
    Image|endswith: '\rundll32.exe'
    CommandLine|contains: 'DavSetCookie'
condition: selection and not rundllexception

False positives (as the rule lists them)

• Unknown

Tags

• attack.privilege_escalation
• attack.t1134
• attack.t1134.002

MITRE ATT&CK ids this rule names

• T1134
• T1134.002

References

• https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
• https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/unsupported/windows/win_possible_privilege_escalation_using_rotten_potato.yml