diff --git a/docs/images/prowler-app/attack-paths/execute-query.png b/docs/images/prowler-app/attack-paths/execute-query.png index 3872f0de2f..683c7c5bd3 100644 Binary files a/docs/images/prowler-app/attack-paths/execute-query.png and b/docs/images/prowler-app/attack-paths/execute-query.png differ diff --git a/docs/images/prowler-app/attack-paths/fullscreen-mode.png b/docs/images/prowler-app/attack-paths/fullscreen-mode.png index c5156925ba..190d973638 100644 Binary files a/docs/images/prowler-app/attack-paths/fullscreen-mode.png and b/docs/images/prowler-app/attack-paths/fullscreen-mode.png differ diff --git a/docs/images/prowler-app/attack-paths/graph-filtered.png b/docs/images/prowler-app/attack-paths/graph-filtered.png index 3ff4822a26..3eddf04473 100644 Binary files a/docs/images/prowler-app/attack-paths/graph-filtered.png and b/docs/images/prowler-app/attack-paths/graph-filtered.png differ diff --git a/docs/images/prowler-app/attack-paths/graph-visualization.png b/docs/images/prowler-app/attack-paths/graph-visualization.png index 2ea160a6b2..d7f2a747eb 100644 Binary files a/docs/images/prowler-app/attack-paths/graph-visualization.png and b/docs/images/prowler-app/attack-paths/graph-visualization.png differ diff --git a/docs/images/prowler-app/attack-paths/navigation.png b/docs/images/prowler-app/attack-paths/navigation.png index d133c7f6b4..0526e05e5c 100644 Binary files a/docs/images/prowler-app/attack-paths/navigation.png and b/docs/images/prowler-app/attack-paths/navigation.png differ diff --git a/docs/images/prowler-app/attack-paths/node-details.png b/docs/images/prowler-app/attack-paths/node-details.png index 9343eedd7d..8b02128604 100644 Binary files a/docs/images/prowler-app/attack-paths/node-details.png and b/docs/images/prowler-app/attack-paths/node-details.png differ diff --git a/docs/images/prowler-app/attack-paths/query-parameters.png b/docs/images/prowler-app/attack-paths/query-parameters.png index 9f44f81838..683c7c5bd3 100644 Binary files a/docs/images/prowler-app/attack-paths/query-parameters.png and b/docs/images/prowler-app/attack-paths/query-parameters.png differ diff --git a/docs/images/prowler-app/attack-paths/query-selector.png b/docs/images/prowler-app/attack-paths/query-selector.png index d8b7414156..828183fdbf 100644 Binary files a/docs/images/prowler-app/attack-paths/query-selector.png and b/docs/images/prowler-app/attack-paths/query-selector.png differ diff --git a/docs/images/prowler-app/attack-paths/scan-list-table.png b/docs/images/prowler-app/attack-paths/scan-list-table.png index 092b539dd0..45d0af41dc 100644 Binary files a/docs/images/prowler-app/attack-paths/scan-list-table.png and b/docs/images/prowler-app/attack-paths/scan-list-table.png differ diff --git a/docs/images/prowler-app/findings-triage/findings-triage-note-modal.png b/docs/images/prowler-app/findings-triage/findings-triage-note-modal.png index dba20c300a..9d7926997d 100644 Binary files a/docs/images/prowler-app/findings-triage/findings-triage-note-modal.png and b/docs/images/prowler-app/findings-triage/findings-triage-note-modal.png differ diff --git a/docs/images/prowler-app/findings-triage/findings-triage-status-dropdown.png b/docs/images/prowler-app/findings-triage/findings-triage-status-dropdown.png index 8edf86b86b..7fb7790610 100644 Binary files a/docs/images/prowler-app/findings-triage/findings-triage-status-dropdown.png and b/docs/images/prowler-app/findings-triage/findings-triage-status-dropdown.png differ diff --git a/docs/images/prowler-app/findings-triage/findings-triage-table.png b/docs/images/prowler-app/findings-triage/findings-triage-table.png index d3543ce131..c8fa79e379 100644 Binary files a/docs/images/prowler-app/findings-triage/findings-triage-table.png and b/docs/images/prowler-app/findings-triage/findings-triage-table.png differ diff --git a/docs/user-guide/tutorials/prowler-app-attack-paths.mdx b/docs/user-guide/tutorials/prowler-app-attack-paths.mdx index c463e3144b..b07aebcc4f 100644 --- a/docs/user-guide/tutorials/prowler-app-attack-paths.mdx +++ b/docs/user-guide/tutorials/prowler-app-attack-paths.mdx @@ -21,13 +21,13 @@ By mapping these relationships as a graph, Attack Paths reveals risks that indiv The following prerequisites are required for Attack Paths: - **An AWS provider is configured** with valid credentials in Prowler App. For setup instructions, see [Getting Started with AWS](/user-guide/providers/aws/getting-started-aws). -- **At least one scan has completed** on the configured AWS provider. Attack Paths scans run automatically alongside regular security scans, no separate configuration is required. +- **At least one scan has completed** on the configured AWS provider and produced graph data. Attack Paths scans run automatically alongside regular security scans, no separate configuration is required. ## How Attack Paths Scans Work Attack Paths scans are generated automatically when a security scan runs on an AWS provider. Each completed scan produces graph data that maps relationships between IAM principals, policies, trust configurations, and other resources. -Once the scan finishes and the graph data is ready, the scan appears in the Attack Paths scan table with a **Completed** status. Scans that are still processing display as **Executing** or **Scheduled**. +Once the scan finishes and graph data is ready, the scan appears in the Attack Paths scan table with a **Completed** status and a check in the **Graph** column. Scans that are still queued or running remain visible, but they cannot be selected until graph data is ready. Since Prowler scans all configured providers every **24 hours** by default, @@ -41,25 +41,28 @@ To open Attack Paths, click **Attack Paths** in the left navigation menu. Attack Paths navigation menu entry -The main interface is divided into two areas: +The Attack Paths page guides you through the workflow on one page: -- **Left panel:** A table listing all available Attack Paths scans -- **Right panel:** The query selector, parameter form, and execute controls +- Select a scan with graph data. +- Choose a built-in query or a custom openCypher query. +- Add parameters when the selected query requires them. +- Execute the query and explore the resulting graph. ## Selecting a Scan The scans table displays all Attack Paths scans with the following columns: -- **Provider / Account:** The AWS provider alias and account identifier -- **Last scan date:** When the scan completed -- **Status:** Current state of the scan (Completed, Executing, Scheduled, or Failed) -- **Progress:** Completion percentage for in-progress scans -- **Duration:** Total scan time +- **Select:** A radio button used to choose a scan. The radio button is disabled when graph data is not available. +- **Provider:** The AWS provider alias and account identifier. +- **Last Scan Date:** When the scan completed. +- **Status:** Current state of the scan, such as **Completed**, **Executing**, **Scheduled**, or **Failed**. +- **Graph:** Whether Attack Paths graph data is available for the scan. +- **Duration:** Total scan time. -To select a scan for analysis, click **Select** on any row with a **Completed** status. +To select a scan for analysis, click the radio button on any row with a **Completed** status and available graph data. - Only scans with a **Completed** status and ready graph data can be selected. - Scans that are still executing or have failed appear with disabled action - buttons. + Only scans with graph data can be selected. Disabled rows include a tooltip + that explains why the graph is not available yet. ## Choosing a Query -After selecting a scan, the right panel activates a query dropdown. Each query targets a specific type of privilege escalation or misconfiguration pattern. +After selecting a scan, the query selector becomes available. Each query targets a specific privilege escalation, exposure, inventory, or misconfiguration pattern. To choose a query, click the dropdown and select from the available options. Each option displays: -- **Query name:** A descriptive title (e.g., "IAM Privilege Escalation via AssumeRole") -- **Short description:** A brief summary of what the query detects +- **Query name:** A descriptive title, such as **Internet-Exposed EC2 with Sensitive S3 Access**. +- **Short description:** A brief summary of what the query detects. -Once selected, a description card appears below the dropdown with additional context about the query, including attribution links to external references when available. +Once selected, a description panel appears below the dropdown with more context about the query. ## Configuring Query Parameters -Some queries accept optional or required parameters to narrow the scope of the analysis. When a query has parameters, a dynamic form appears below the query description. +Some queries accept optional or required parameters to narrow the scope of the analysis. When a query has parameters, a form appears below the query description. -- **Required fields** are marked with an asterisk (\*) and must be filled before executing -- **Optional fields** refine the query results but are not mandatory +- **Required fields** are marked with an asterisk (\*) and must be filled before executing. +- **Optional fields** refine the query results but are not mandatory. +- Queries without parameters show no parameter form. -If a query requires no parameters, the form displays a message confirming that the query is ready to execute. +For example, **Internet-Exposed EC2 with Sensitive S3 Access** uses **Tag key** and **Tag value** fields to identify sensitive S3 buckets. Attack Paths right panel with query selected and execute button ## Exploring the Graph -After a successful execution, the graph visualization renders below the query builder in a full-width panel. The graph maps relationships between cloud resources, IAM entities, and security findings. +After a successful execution, the graph visualization renders below the query builder. The graph maps relationships between cloud resources, IAM entities, public exposure, and security findings. ### Node Types -- **Resource nodes** (rounded pills): Represent cloud resources such as IAM roles, policies, EC2 instances, and S3 buckets. Each resource type has a distinct color. -- **Finding nodes** (hexagons): Represent Prowler security findings linked to resources in the graph. Colors indicate severity level (critical, high, medium, low). +- **Provider root nodes:** Represent the AWS account or provider root for the selected scan. +- **Resource nodes:** Represent cloud resources such as IAM roles, policies, EC2 instances, security groups, and S3 buckets. +- **Internet nodes:** Represent exposure from the public internet. +- **Finding nodes:** Represent Prowler findings linked to resources. Finding colors indicate risk level, such as critical, high, medium, or low. ### Edge Types -- **Solid lines:** Direct relationships between resources (e.g., a role attached to a policy) -- **Dashed lines:** Connections between resources and their associated findings +- **Normal edges:** Direct relationships between graph nodes, such as role-to-policy or resource-to-security-group relationships. +- **Finding edges:** Dashed relationships between resources and their associated findings. +- **Highlighted paths:** Green edges that show the active path when you hover a node or focus a finding. -A **legend** at the bottom of the graph lists all node types and edge types present in the current view. +The standard graph view includes a minimap and a legend below the canvas. The legend shows the provider roots, visible node types, finding risk levels, node states, and edge types present in the current view. Attack Paths graph showing nodes, edges, and legend ## Interacting with the Graph -### Filtering by Node +The graph banner describes the main interactions: -Click any node in the graph to filter the view and display only paths that pass through that node. When a filter is active: +- Click a finding to focus its connected path. +- Click a resource with findings to show or hide its related findings. +- Hover a node to highlight its connected path. -- An information banner shows which node is selected -- Click **Back to Full View** to restore the complete graph +### Showing Related Findings + +Resource nodes with related findings are clickable. Click one of these resources to show its finding nodes. Click the resource again to hide them. + +The graph automatically fits the selected resource and its related findings when the findings are shown. + +### Focusing a Finding Path + +Click a finding node to focus the graph on the path connected to that finding. When the graph is focused: + +- The graph shows **Back to Full View**. +- The status banner shows the selected finding. +- The graph keeps only the connected path in view. +- The finding detail drawer opens. + +After you close the drawer, the graph remains focused on the selected path. Attack Paths graph filtered to show paths through a selected node @@ -339,29 +364,29 @@ Click any node in the graph to filter the view and display only paths that pass The toolbar in the top-right corner of the graph provides: - **Zoom in / Zoom out:** Adjust the zoom level -- **Fit to screen:** Reset the view to fit all nodes -- **Export:** Download the current graph as an SVG file -- **Fullscreen:** Open the graph in a full-screen modal with a side-by-side node detail panel +- **Fit graph to view:** Reset the view to fit the visible graph +- **Export graph:** Download the current graph as a PNG file +- **Fullscreen:** Open the graph in a full-size modal Use **Ctrl + Scroll** (or **Cmd + Scroll** on macOS) to zoom directly within the graph area. -## Viewing Node Details +## Viewing Finding Details -Click any node to open the **Node Details** panel below the graph. This panel displays: +Click a finding node to open the finding detail drawer. The drawer uses the same finding detail layout as the Findings page and includes: -- **Node type:** The resource category (e.g., "IAM Role," "EC2 Instance") -- **Properties:** All attributes of the selected node, including identifiers, timestamps, and configuration details -- **Related findings** (for resource nodes): A list of Prowler findings linked to the resource, with severity, title, and status -- **Affected resources** (for finding nodes): A list of resources associated with the finding +- The finding title, status, and severity. +- The affected resource summary. +- Overview, remediation, evidence, related findings, scans, and events tabs when data is available. +- A Lighthouse AI action when the account has access to Lighthouse AI. -For finding nodes, a "View Finding" button links directly to the finding detail page for further investigation. +Resource nodes do not open a node detail panel. When a resource has related findings, clicking it expands or collapses those finding nodes in the graph. Attack Paths node detail panel showing properties and related findings @@ -369,16 +394,28 @@ For finding nodes, a "View Finding" button links directly to the finding detail To expand the graph for detailed exploration, click the fullscreen icon in the graph toolbar. The fullscreen modal provides: -- The full graph visualization with all zoom and export controls -- A side panel for node details that appears when a node is selected -- All filtering and interaction capabilities available in the standard view +- The graph in a full-size modal. +- The same zoom, fit, and export controls. +- The same node expansion, finding focus, hover highlight, and minimap interactions available in the standard view. Attack Paths fullscreen mode with graph and node detail side panel +## Available Queries + +The query selector includes custom openCypher and built-in AWS queries for common security investigation workflows. Available queries are loaded from the selected scan and may change as new query packs are added. + +Available queries include: + +- **Custom openCypher query:** Write and run a read-only graph query. +- **Exposure queries:** Find internet-exposed EC2 instances, load balancers, open security groups, and resources by public IP. +- **Inventory queries:** List resources such as RDS instances. +- **Misconfiguration queries:** Find unencrypted RDS instances, public S3 buckets, and wildcard IAM statements. +- **Privilege escalation queries:** Detect IAM and AWS service paths based on known attack techniques, including queries based on [pathfinding.cloud](https://pathfinding.cloud) research by Datadog. + ## Using Attack Paths with the MCP Server and Lighthouse AI Attack Paths capabilities are also available through the [Prowler MCP Server](/getting-started/products/prowler-mcp), enabling interaction with Attack Paths data via AI assistants like Claude Desktop, Cursor, and other MCP clients. @@ -387,10 +424,10 @@ Attack Paths capabilities are also available through the [Prowler MCP Server](/g The following MCP tools are available for Attack Paths: -- **`prowler_app_list_attack_paths_scans`** - List and filter Attack Paths scans -- **`prowler_app_list_attack_paths_queries`** - Discover available queries for a completed scan -- **`prowler_app_run_attack_paths_query`** - Execute a query and retrieve graph results with nodes and relationships -- **`prowler_app_get_attack_paths_cartography_schema`** - Retrieve the Cartography graph schema for custom openCypher queries +- **`prowler_app_list_attack_paths_scans`** - List and filter Attack Paths scans. +- **`prowler_app_list_attack_paths_queries`** - Discover available queries for a completed scan. +- **`prowler_app_run_attack_paths_query`** - Execute a query and retrieve graph results with nodes and relationships. +- **`prowler_app_get_attack_paths_cartography_schema`** - Retrieve the Cartography graph schema for custom openCypher queries. ### Example Questions @@ -405,110 +442,6 @@ Ask through the MCP Server or Lighthouse AI: - "Are there any CloudFormation stacks that could be hijacked for privilege escalation?" - "Show me all roles that can be assumed for lateral movement" -### Supported Queries - -Attack Paths currently supports the following built-in queries for AWS: - -#### Custom Attack Path Queries - -| Query | Description | -| ------------------------------------------------- | ---------------------------------------------------------------------------------------- | -| **Internet-Exposed EC2 with Sensitive S3 Access** | Find SSH-exposed EC2 instances that can assume roles to read tagged sensitive S3 buckets | - -#### Basic Resource Queries - -| Query | Description | -| ------------------------------------------- | ------------------------------------------------------------------- | -| **RDS Instances Inventory** | List all provisioned RDS database instances in the account | -| **Unencrypted RDS Instances** | Find RDS instances with storage encryption disabled | -| **S3 Buckets with Anonymous Access** | Find S3 buckets that allow anonymous access | -| **IAM Statements Allowing All Actions** | Find IAM policy statements that allow all actions via wildcard (\*) | -| **IAM Statements Allowing Policy Deletion** | Find IAM policy statements that allow iam:DeletePolicy | -| **IAM Statements Allowing Create Actions** | Find IAM policy statements that allow any create action | - -#### Network Exposure Queries - -| Query | Description | -| ----------------------------------------------------- | ----------------------------------------------------------------------------------- | -| **Internet-Exposed EC2 Instances** | Find EC2 instances flagged as exposed to the internet | -| **Open Security Groups on Internet-Facing Resources** | Find internet-facing resources with security groups allowing inbound from 0.0.0.0/0 | -| **Internet-Exposed Classic Load Balancers** | Find Classic Load Balancers exposed to the internet with their listeners | -| **Internet-Exposed ALB/NLB Load Balancers** | Find ELBv2 (ALB/NLB) load balancers exposed to the internet with their listeners | -| **Resource Lookup by Public IP** | Find the AWS resource associated with a given public IP address | - -#### Privilege Escalation Queries - -These queries are based on research from [pathfinding.cloud](https://pathfinding.cloud) by Datadog. - -| Query | Description | -| -------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| **App Runner Service Creation with Privileged Role (APPRUNNER-001)** | Create an App Runner service with a privileged IAM role to gain its permissions | -| **App Runner Service Update for Role Access (APPRUNNER-002)** | Update an existing App Runner service to leverage its already-attached privileged role | -| **Bedrock Code Interpreter with Privileged Role (BEDROCK-001)** | Create a Bedrock AgentCore Code Interpreter with a privileged role attached | -| **Bedrock Code Interpreter Session Hijacking (BEDROCK-002)** | Start a session on an existing Bedrock code interpreter to exfiltrate its privileged role credentials | -| **CloudFormation Stack Creation with Privileged Role (CLOUDFORMATION-001)** | Create a CloudFormation stack with a privileged role to provision arbitrary AWS resources | -| **CloudFormation Stack Update for Role Access (CLOUDFORMATION-002)** | Update an existing CloudFormation stack to leverage its already-attached privileged service role | -| **CloudFormation StackSet Creation with Privileged Role (CLOUDFORMATION-003)** | Create a CloudFormation StackSet with a privileged execution role to provision arbitrary resources across accounts | -| **CloudFormation StackSet Update with Privileged Role (CLOUDFORMATION-004)** | Update an existing CloudFormation StackSet to inject malicious resources using a privileged execution role | -| **CloudFormation Change Set Privilege Escalation (CLOUDFORMATION-005)** | Create and execute a change set on an existing stack to leverage its privileged service role | -| **CodeBuild Project Creation with Privileged Role (CODEBUILD-001)** | Create a CodeBuild project with a privileged role to execute arbitrary code via a malicious buildspec | -| **CodeBuild Buildspec Override for Role Access (CODEBUILD-002)** | Start a build on an existing CodeBuild project with a buildspec override to execute code with its privileged role | -| **CodeBuild Batch Buildspec Override for Role Access (CODEBUILD-003)** | Start a batch build on an existing CodeBuild project with a buildspec override to execute code with its privileged role | -| **CodeBuild Batch Project Creation with Privileged Role (CODEBUILD-004)** | Create a CodeBuild project configured for batch builds with a privileged role to execute arbitrary code via a malicious buildspec | -| **Data Pipeline Creation with Privileged Role (DATAPIPELINE-001)** | Create a Data Pipeline with a privileged role to execute arbitrary commands on provisioned infrastructure | -| **EC2 Instance Launch with Privileged Role (EC2-001)** | Launch EC2 instances with privileged IAM roles to gain their permissions via IMDS | -| **EC2 Role Hijacking via UserData Injection (EC2-002)** | Inject malicious scripts into EC2 instance userData to gain the attached role's permissions | -| **Spot Instance Launch with Privileged Role (EC2-003)** | Launch EC2 Spot Instances with privileged IAM roles to gain their permissions via IMDS | -| **Launch Template Poisoning for Role Access (EC2-004)** | Inject malicious userData into launch templates that reference privileged roles, no PassRole needed | -| **EC2 Instance Connect SSH Access for Role Credentials (EC2INSTANCECONNECT-003)** | Push a temporary SSH key to an EC2 instance via Instance Connect to access its attached role credentials through IMDS | -| **ECS Service Creation with Privileged Role (ECS-001 - New Cluster)** | Create an ECS cluster and service with a privileged Fargate task role to execute arbitrary code | -| **ECS Task Execution with Privileged Role (ECS-002 - New Cluster)** | Create an ECS cluster and run a one-off Fargate task with a privileged role to execute arbitrary code | -| **ECS Service Creation with Privileged Role (ECS-003 - Existing Cluster)** | Deploy a Fargate service with a privileged role on an existing ECS cluster | -| **ECS Task Execution with Privileged Role (ECS-004 - Existing Cluster)** | Run a one-off Fargate task with a privileged role on an existing ECS cluster | -| **ECS Task Start with Privileged Role on EC2 (ECS-005 - Existing Cluster)** | Register a task definition with a privileged role and start it on an EC2 container instance to execute arbitrary code | -| **ECS Exec Container Hijacking for Role Credentials (ECS-006)** | Shell into a running ECS container via ECS Exec to steal the attached task role's credentials | -| **Glue Dev Endpoint with Privileged Role (GLUE-001)** | Create a Glue development endpoint with a privileged role attached to gain its permissions | -| **Glue Dev Endpoint SSH Hijacking via Update (GLUE-002)** | Update an existing Glue development endpoint to inject an SSH public key and access its attached role credentials | -| **Glue Job Creation with Privileged Role (GLUE-003)** | Create a Glue job with a privileged role and start it to execute arbitrary code with that role's permissions | -| **Glue Job Creation with Scheduled Trigger and Privileged Role (GLUE-004)** | Create a Glue job with a privileged role and a scheduled trigger to persistently execute arbitrary code | -| **Glue Job Hijacking via Update with Privileged Role (GLUE-005)** | Update an existing Glue job to attach a privileged role and inject malicious code, then start it to gain that role's permissions | -| **Glue Job Hijacking with Scheduled Trigger and Privileged Role (GLUE-006)** | Update an existing Glue job to attach a privileged role and inject malicious code, then create a scheduled trigger for persistent automated execution | -| **Policy Version Override for Self-Escalation (IAM-001)** | Create a new version of an attached policy with administrative permissions, instantly escalating the principal's own privileges | -| **Access Key Creation for Lateral Movement (IAM-002)** | Create access keys for other IAM users to gain their permissions and move laterally across the account | -| **Access Key Rotation Attack for Lateral Movement (IAM-003)** | Delete and recreate access keys for other IAM users to bypass the two-key limit and gain their permissions | -| **Console Login Profile Creation for Lateral Movement (IAM-004)** | Create console login profiles for other IAM users to access the AWS Console with their permissions | -| **Inline Policy Injection for Self-Escalation (IAM-005)** | Attach an inline policy with administrative permissions to your own role, instantly escalating privileges | -| **Console Password Override for Lateral Movement (IAM-006)** | Change the console password of other IAM users to log in as them and gain their permissions | -| **Inline Policy Injection on User for Self-Escalation (IAM-007)** | Attach an inline policy with administrative permissions to your own IAM user, instantly escalating privileges | -| **Managed Policy Attachment on User for Self-Escalation (IAM-008)** | Attach existing managed policies with administrative permissions to your own IAM user, instantly escalating privileges | -| **Managed Policy Attachment on Role for Self-Escalation (IAM-009)** | Attach existing managed policies with administrative permissions to your own IAM role, instantly escalating privileges | -| **Managed Policy Attachment on Group for Self-Escalation (IAM-010)** | Attach existing managed policies with administrative permissions to a group you belong to, escalating privileges for all group members | -| **Inline Policy Injection on Group for Self-Escalation (IAM-011)** | Attach an inline policy with administrative permissions to a group you belong to, escalating privileges for all group members | -| **Trust Policy Hijacking for Role Assumption (IAM-012)** | Modify a role's trust policy to allow yourself to assume it, gaining the role's permissions | -| **Group Membership Hijacking for Privilege Escalation (IAM-013)** | Add yourself to a privileged IAM group to inherit its permissions, gaining access to all policies attached to the group | -| **Managed Policy Attachment with Role Assumption for Lateral Movement (IAM-014)** | Attach administrative managed policies to another role you can assume, then assume it to gain elevated privileges | -| **Managed Policy Attachment with Access Key Creation for Lateral Movement (IAM-015)** | Attach administrative managed policies to another IAM user and create access keys for them to gain programmatic access with elevated privileges | -| **Policy Version Override with Role Assumption for Lateral Movement (IAM-016)** | Create a new version of a customer-managed policy attached to another role with administrative permissions, then assume that role to gain elevated access | -| **Inline Policy Injection with Role Assumption for Lateral Movement (IAM-017)** | Attach an inline policy with administrative permissions to another role you can assume, then assume it to gain elevated privileges | -| **Inline Policy Injection with Access Key Creation for Lateral Movement (IAM-018)** | Attach an inline policy with administrative permissions to another IAM user and create access keys for them to gain programmatic access with elevated privileges | -| **Managed Policy Attachment with Trust Policy Hijacking for Privilege Escalation (IAM-019)** | Attach administrative managed policies to a role and modify its trust policy to allow yourself to assume it, gaining elevated privileges without prior assume-role access | -| **Policy Version Override with Trust Policy Hijacking for Privilege Escalation (IAM-020)** | Create a new version of a customer-managed policy attached to a role with administrative permissions and modify its trust policy to assume it, without prior assume-role access | -| **Inline Policy Injection with Trust Policy Hijacking for Privilege Escalation (IAM-021)** | Add an inline policy with administrative permissions to a role and modify its trust policy to allow yourself to assume it, gaining elevated privileges without prior assume-role access | -| **Lambda Function Creation with Privileged Role (LAMBDA-001)** | Create a Lambda function with a privileged IAM role and invoke it to execute code with that role's permissions | -| **Lambda Function Creation with Event Source Trigger (LAMBDA-002)** | Create a Lambda function with a privileged IAM role and an event source mapping to trigger it automatically, executing code with the role's permissions | -| **Lambda Function Code Injection (LAMBDA-003)** | Modify the code of an existing Lambda function to execute arbitrary commands with the function's execution role permissions | -| **Lambda Function Code Injection with Direct Invocation (LAMBDA-004)** | Modify the code of an existing Lambda function and invoke it directly to execute arbitrary commands with the function's execution role permissions | -| **Lambda Function Code Injection with Resource Policy Grant (LAMBDA-005)** | Modify the code of an existing Lambda function and grant yourself invocation permission via its resource-based policy to execute code with the function's execution role | -| **Lambda Function Creation with Resource Policy Invocation (LAMBDA-006)** | Create a Lambda function with a privileged IAM role and grant yourself invocation permission via its resource-based policy to execute code with the role's permissions | -| **SageMaker Notebook Creation with Privileged Role (SAGEMAKER-001)** | Create a SageMaker notebook instance with a privileged IAM role to execute arbitrary code with the role's permissions via the Jupyter environment | -| **SageMaker Training Job Creation with Privileged Role (SAGEMAKER-002)** | Create a SageMaker training job with a privileged IAM role to execute arbitrary container code with the role's permissions | -| **SageMaker Processing Job Creation with Privileged Role (SAGEMAKER-003)** | Create a SageMaker processing job with a privileged IAM role to execute arbitrary container code with the role's permissions | -| **SageMaker Presigned Notebook URL for Privilege Escalation (SAGEMAKER-004)** | Generate a presigned URL to access an existing SageMaker notebook instance and execute code with its execution role's permissions | -| **SageMaker Notebook Lifecycle Config Injection (SAGEMAKER-005)** | Inject a malicious lifecycle configuration into an existing SageMaker notebook to execute code with the notebook's execution role during startup | -| **SSM Session Access for EC2 Role Credentials (SSM-001)** | Start an SSM session on an EC2 instance to access its attached role credentials through IMDS | -| **SSM Send Command for EC2 Role Credentials (SSM-002)** | Execute commands on an EC2 instance via SSM Run Command to access its attached role credentials through IMDS | -| **Role Assumption for Privilege Escalation (STS-001)** | Assume IAM roles with elevated permissions by exploiting bidirectional trust between the starting principal and the target role | - These tools enable workflows such as: - Asking an AI assistant to identify privilege escalation paths in a specific AWS account