Potato Family / SeImpersonatePrivilege → SYSTEM Response
When SYSTEM token acquisition via JuicyPotato, RoguePotato, PrintSpoofer, or GodPotato through an IIS, MSSQL, or service account with SeImpersonatePrivilege is suspected, performs service context analysis, containment, and service hardening steps.
SeImpersonatePrivilege rely on processes running in a service account context impersonating the SYSTEM token. IIS and SQL Server application pools should run under dedicated, minimally privileged service accounts, and those accounts must not be granted SeImpersonatePrivilege. Evidence of token theft is tracked in Windows Security EID 4624 (Logon Type 3/9) and the Sysmon EID 1 process tree.Prepare
4 steps- Sysmon named pipe telemetry validation
Periodically verify that EID 17/18 (PipeEvent) unexpected named pipes in service account context and high-integrity child processes spawned from IIS APPPOOL, NETWORK SERVICE, or MSSQL parents in EID 1 are being forwarded to SIEM.
- SeImpersonatePrivilege inventory
List all service accounts in the environment that have `SeImpersonatePrivilege`; IIS, MSSQL, Exchange, and WCF have this privilege by default; document accounts that cannot be migrated to gMSA.
- PrintSpoofer/PrintNotify advisory
Disabling `spoolsv.exe` alone does not prevent PrintSpoofer attacks; if the Print Workflow/PrintNotify service (`PrintWorkflowUserSvc`) is running, the attack surface remains open; the status of both must be monitored.
- Escalation chain
If a web server or database server is affected, IR Lead, application owner, and CISO must be engaged simultaneously; initial access vector investigation is opened in parallel.