Named Pipe Impersonation Abuse — PrintSpoofer / RoguePotato / GodPotato

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•3

Detects the creation of suspicious named pipes by low-privilege processes, which is a technique used by local privilege escalation tools (like PrintSpoofer, RoguePotato, and GodPotato) to intercept and impersonate high-privilege (SYSTEM) tokens.