From 3c599a75cc3be74056d55f1076fc783de73fa622 Mon Sep 17 00:00:00 2001
From: Andoni Alonso <14891798+andoniaf@users.noreply.github.com>
Date: Wed, 20 Aug 2025 09:23:30 +0200
Subject: [PATCH] feat(iam): add ECS privilege escalation patterns to IAM
 checks (#8541)

---
 prowler/CHANGELOG.md                                 |  2 ++
 .../aws/services/iam/lib/privilege_escalation.py     | 12 ++++++++++++
 2 files changed, 14 insertions(+)

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index dec6f062ae..64db6f51f3 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -11,6 +11,8 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - Bedrock AgentCore privilege escalation combination for AWS provider [(#8526)](https://github.com/prowler-cloud/prowler/pull/8526)
 - Remove standalone iam:PassRole from privesc detection and add missing patterns [(#8530)](https://github.com/prowler-cloud/prowler/pull/8530)
 - `eks_cluster_deletion_protection_enabled` check for AWS provider [(#8536)](https://github.com/prowler-cloud/prowler/pull/8536)
+- ECS privilege escalation patterns (StartTask and RunTask) for AWS provider [(#8541)](https://github.com/prowler-cloud/prowler/pull/8541)
+
 
 ### Changed
 - Refine kisa isms-p compliance mapping [(#8479)](https://github.com/prowler-cloud/prowler/pull/8479)
diff --git a/prowler/providers/aws/services/iam/lib/privilege_escalation.py b/prowler/providers/aws/services/iam/lib/privilege_escalation.py
index 9a4a67d3ab..b2545dfce0 100644
--- a/prowler/providers/aws/services/iam/lib/privilege_escalation.py
+++ b/prowler/providers/aws/services/iam/lib/privilege_escalation.py
@@ -106,6 +106,18 @@ privilege_escalation_policies_combination = {
         "bedrock-agentcore:CreateCodeInterpreter",
         "bedrock-agentcore:InvokeCodeInterpreter",
     },
+    # ECS-based privilege escalation patterns
+    # Reference: https://labs.reversec.com/posts/2025/08/another-ecs-privilege-escalation-path
+    "PassRole+ECS+StartTask": {
+        "iam:PassRole",
+        "ecs:StartTask",
+        "ecs:RegisterContainerInstance",
+        "ecs:DeregisterContainerInstance",
+    },
+    "PassRole+ECS+RunTask": {
+        "iam:PassRole",
+        "ecs:RunTask",
+    },
     # TO-DO: We have to handle AssumeRole just if the resource is * and without conditions
     # "sts:AssumeRole": {"sts:AssumeRole"},
 }