rage.fail

execute-as-via-code-modify

Modify code of a compute resource that runs as a privileged identity.

derived any cloud emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'attacker': None} CanModifyCode {'compute': None} {'compute': None} ExecutesAs {'identity': None}

where

node_class(?compute) in [Compute, AnalyticsService, DataWarehouse, DataLake]

optional

Present → upgrade the emitted state; absent → downgrade (not a hard requirement).

{'attacker': None} CanInvoke {'compute': None}

emit

source type	`Identity`
target type	`Identity`
source	`?attacker`
target	`?identity`
state logic	ACTIVE if matched(optional[0]) or trigger_exists(?compute) else CONDITIONAL(trigger_exists)

Raw rule rules/derived/can-execute-as.yaml

id: execute-as-via-code-modify
emits: CanExecuteAs
description: Modify code of a compute resource that runs as a privileged identity.
applies_to:
- '*'
match:
- - attacker: null
  - CanModifyCode
  - compute: null
- - compute: null
  - ExecutesAs
  - identity: null
where:
- node_class(?compute) in [Compute, AnalyticsService, DataWarehouse, DataLake]
optional:
- - attacker: null
  - CanInvoke
  - compute: null
emit:
  source_type: Identity
  target_type: Identity
  source: ?attacker
  target: ?identity
  state_logic: ACTIVE if matched(optional[0]) or trigger_exists(?compute) else CONDITIONAL(trigger_exists)
  derived_from:
  - ?attacker CanModifyCode ?compute
  - ?compute ExecutesAs ?identity
  evidence:
    narrative_template: '{attacker.name} can run code as {identity.name}: it can modify the code of {compute.name}
      ({perm:CanModifyCode}); {compute.name} executes as {identity.name}{if optional[0]: " and {attacker.name}
      can invoke it"}.

      '