rage.fail

execute-as-via-command

Run OS commands on a host that already runs as a privileged identity.

derived any cloud emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'attacker': None} CanExecuteCommand {'compute': None} {'compute': None} ExecutesAs {'identity': None}

emit

source type	`Identity`
target type	`Identity`
source	`?attacker`
target	`?identity`
state logic	ACTIVE

Raw rule rules/derived/can-execute-as.yaml

id: execute-as-via-command
emits: CanExecuteAs
description: Run OS commands on a host that already runs as a privileged identity.
applies_to:
- '*'
match:
- - attacker: null
  - CanExecuteCommand
  - compute: null
- - compute: null
  - ExecutesAs
  - identity: null
emit:
  source_type: Identity
  target_type: Identity
  source: ?attacker
  target: ?identity
  state_logic: ACTIVE
  derived_from:
  - ?attacker CanExecuteCommand ?compute
  - ?compute ExecutesAs ?identity