aws-ds-escalate-via-domain-admin-reset

Resetting the password of a domain-admin directory user yields privilege escalation to domain-admin access over all domain-joined resources.

derived aws emits CanEscalateTo

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanResetCredential {'user': None} {'user': None} MemberOf {'group': None}

where

node_type(?user) == HumanIdentity node_type(?group) == Group ?group.name in ['Domain Admins', 'Enterprise Admins', 'Schema Admins', 'BUILTIN\Administrators'] ?user.directory_id == ?group.directory_id # same directory scope privilege(?user) > privilege(?principal) # genuine escalation

emit

source type	`Identity`
target type	`Identity`
source	`?principal`
target	`?user`
permissions	`ds:ResetUserPassword`
conditions	`iam_permission` `permission_boundary` `scp_or_org_policy` `service_state`
state logic	ACTIVE when the principal has effective ds:ResetUserPassword on the directory ARN and the user's MemberOf(Domain Admins \| Enterprise Admins \| Schema Admins \| BUILTIN\Administrators) is confirmed AND the target user is more privileged than the calling principal. CONDITIONAL(service_state) if the directory is in a non-Active state (e.g. 'Impaired', 'RestoreFailed') — password reset may fail transiently. BLOCKED if an SCP denies ds:ResetUserPassword at the account scope, or if a permission boundary caps the ds:ResetUserPassword action for the principal.

Narrative

{principal.name} can reset the password of {user.name} (ds:ResetUserPassword on directory {user.directory_id}); {user.name} is a member of {group.name}, granting {principal.name} domain-level administrative access to all domain-joined resources in the managed Active Directory domain.

Raw rule rules/derived/aws/ds.yaml

id: aws-ds-escalate-via-domain-admin-reset
emits: CanEscalateTo
description: Resetting the password of a domain-admin directory user yields privilege escalation to domain-admin
  access over all domain-joined resources.
match:
- - principal: null
  - CanResetCredential
  - user: null
- - user: null
  - MemberOf
  - group: null
where:
- node_type(?user) == HumanIdentity
- node_type(?group) == Group
- ?group.name in ['Domain Admins', 'Enterprise Admins', 'Schema Admins', 'BUILTIN\Administrators']
- '?user.directory_id == ?group.directory_id  # same directory scope'
- 'privilege(?user) > privilege(?principal)  # genuine escalation'
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?user
  permissions:
  - ds:ResetUserPassword
  conditions:
  - iam_permission
  - permission_boundary
  - scp_or_org_policy
  - service_state
  state_logic: "ACTIVE when the principal has effective ds:ResetUserPassword on the directory ARN and\
    \ the user's MemberOf(Domain Admins | Enterprise Admins | Schema Admins | BUILTIN\\Administrators)\
    \ is confirmed AND the target user is more privileged than the calling principal. CONDITIONAL(service_state)\
    \ if the directory is in a non-Active state (e.g. 'Impaired', 'RestoreFailed') \u2014 password reset\
    \ may fail transiently. BLOCKED if an SCP denies ds:ResetUserPassword at the account scope, or if\
    \ a permission boundary caps the ds:ResetUserPassword action for the principal."
  confidence: min(contributing_confidences) * 0.9
  derived_from:
  - '<CanResetCredential edge_id: ?principal -> ?user>'
  - '<MemberOf edge_id: ?user -> ?group>'
  false_positive_note: "Only emit when the target user is a member of a privileged AD group (Domain Admins,\
    \ Enterprise Admins, Schema Admins, BUILTIN\\Administrators) confirmed by collected MemberOf data\
    \ \u2014 do NOT guess membership. Requires privilege(?user) > privilege(?principal); a lateral same-privilege\
    \ reset is CanResetCredential but not CanEscalateTo. The resulting access is Windows-domain escalation\
    \ (domain-joined EC2 / RDP / Windows services), NOT direct AWS IAM escalation. AWS API access from\
    \ this path requires an additional SAML federation step via an AD FS instance configured as a SAML\
    \ IdP (see aws-assume-role-web-identity in identity-escalation.yaml, cited but not duplicated here).\
    \ Do NOT emit for Simple AD or AD Connector directories where the directory type does not support\
    \ domain admin groups."
  narrative: '{principal.name} can reset the password of {user.name} (ds:ResetUserPassword on directory
    {user.directory_id}); {user.name} is a member of {group.name}, granting {principal.name} domain-level
    administrative access to all domain-joined resources in the managed Active Directory domain.'