W-NAMED-PIPE-IMPPrivilege Escalation

Named Pipe Impersonation

Tools like JuicyPotato / RoguePotato / GodPotato — impersonate a SYSTEM token via a named pipe primitive (still works for service accounts with SeImpersonatePrivilege).

§ Where this technique fits

W-NAMED-PIPE-IMP is catalogued under the Privilege Escalation tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 3 on average.

§ Dossiers chaining this technique

Service account → SYSTEM via named-pipe impersonation
Service-context shell has SeImpersonatePrivilege. Use Potato-family tools (Juicy / Rogue / Print / God) to coerce SYSTEM to authenticate to an attacker-controlled named pipe, then impersonate the token.
step 3 / 5

§ What commonly comes next

01
Command and Scripting Interpreter
T1059 · Execution
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

Service account → SYSTEM via named-pipe impersonation

§ What commonly comes next