Token Impersonation via JuicyPotato, RoguePotato, or PrintSpoofer

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•2

Detects the execution of known privilege escalation tools (JuicyPotato, RoguePotato, PrintSpoofer) or command-line arguments indicative of token impersonation attempts (e.g., usage of SeImpersonatePrivilege) to escalate privileges on Windows systems.