rage.fail

escalate-via-execute-as

Executing as a strictly-more-privileged identity is escalation.

derived any cloud emits CanEscalateTo

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'attacker': None} CanExecuteAs {'identity': None}

where

privilege(?identity) > privilege(?attacker)

emit

source type	`Identity`
target type	`Identity`
source	`?attacker`
target	`?identity`
state logic	inherit from CanExecuteAs

Raw rule rules/derived/can-control.yaml

id: escalate-via-execute-as
emits: CanEscalateTo
description: Executing as a strictly-more-privileged identity is escalation.
applies_to:
- '*'
match:
- - attacker: null
  - CanExecuteAs
  - identity: null
where:
- privilege(?identity) > privilege(?attacker)
emit:
  source_type: Identity
  target_type: Identity
  source: ?attacker
  target: ?identity
  state_logic: inherit from CanExecuteAs
  derived_from:
  - ?attacker CanExecuteAs ?identity