Juicypotato
Overview
Executive Summary
JuicyPotato is a highly potent, open-source post-exploitation "HackTool" used to achieve Local Privilege Escalation (LPE) on Microsoft Windows operating systems. It exploits a known vulnerability in the way Windows handles DCOM (Distributed Component Object Model) authentication. When executed by an attacker who already possesses low-level access (e.g., a standard user or a compromised service account), JuicyPotato allows them to elevate their privileges to `NT AUTHORITY\SYSTEM`, granting them absolute control over the compromised machine.Infection Vector and Technical Capabilities
JuicyPotato is not an initial infection vector (like a trojan or worm). It is a specialized tool deployed *after* an attacker has already breached the perimeter. It is frequently utilized during penetration tests and by malicious actors following the compromise of a web server (e.g., gaining an IIS AppPool service account via a web shell). Its execution relies on exploiting the `SeImpersonatePrivilege` or `SeAssignPrimaryTokenPrivilege`:- Rogue COM Server: The tool creates a rogue COM server and tricks a high-privileged Windows service (running as SYSTEM) into authenticating with it.
- NTLM Reflection: It captures the NTLM authentication traffic from the SYSTEM account and reflects it back to the local machine, effectively stealing the SYSTEM token.
- Token Impersonation: Using the `SeImpersonatePrivilege`, the attacker applies the stolen SYSTEM token to a new process (e.g., launching `cmd.exe` or a reverse shell), instantly granting them full administrative rights.
Threat Assessment
The detection of JuicyPotato on a network is a critical incident indicating a severe escalation of an existing breach. An attacker operating as SYSTEM can disable antivirus, dump credentials from LSASS memory, install rootkits, and move laterally across the Active Directory environment without restriction.Incident Response and Remediation
- Immediate Containment: Isolate the compromised host immediately. Because the attacker has SYSTEM privileges, they likely have deeply embedded persistence mechanisms that standard AV cannot remove.
- Patching and Configuration: While Microsoft has patched specific DCOM vectors, the fundamental issue relies on service accounts possessing `SeImpersonatePrivilege`. Ensure servers are fully patched. More importantly, adhere to the Principle of Least Privilege: do not grant service accounts (like IIS or SQL service accounts) local administrative rights or the `SeImpersonatePrivilege` unless strictly required.
- Complete Rebuild: The only secure remediation for a machine where an attacker has achieved SYSTEM level access is a complete bare-metal wipe and re-image from a trusted source.
Known aliases
Threat reports may refer to this family under multiple names:
MITRE ATT&CK Techniques
This family has been observed using the following ATT&CK techniques: T1134.001 T1068 T1548.002
Generated Detections (Boilerplate)
These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.
YARA Rule
rule MALWARE_WIN_JUICYPOTATO {
meta:
description = "Detects Juicypotato (trojan)"
author = "SystemHelpdesk Boilerplate Generator"
date = "2026-07-06"
strings:
$s1 = "juicypotato" ascii wide nocase
$s2 = "hacktool.juicypotato" ascii wide nocase
$s3 = "riskware.juicypotato" ascii wide nocase
$s4 = "exploit.lpe.juicypotato" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}Sigma Rule
title: Suspicious Juicypotato Activity
id: 89f15acb31deac634e3fa4824d048e1b
status: experimental
description: Detects generic indicators of the juicypotato malware family.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
CommandLine|contains:
- "*juicypotato*"
- "*hacktool.juicypotato*"
- "*riskware.juicypotato*"
- "*exploit.lpe.juicypotato*"
condition: selection
level: mediumReferences & External Analysis
- Search "juicypotato" on VirusTotal (External Analysis)
Frequently Asked Questions
How do I remove the Juicypotato Trojan from Windows?
Manual removal of Juicypotato is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.
Is Juicypotato a virus or a Trojan?
Juicypotato is classified as a Trojan. Unlike traditional viruses that infect files, modern malware like Juicypotato typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.
What are the main symptoms of a Juicypotato infection?
Symptoms of Juicypotato can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.
Related Families (Category: trojan)
Explore other malware families in the same category:
Protect Your Network Against Trojans
Want to prevent Juicypotato and similar threats from compromising your organization? Read our comprehensive defensive guide: Banking Trojan Protection.
Machine-readable
Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/juicypotato.json
Ecosystem & Interactive Environments
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.