rage.fail

execute-as-via-new-workload

Create a new workload and attach a privileged identity to it.

derived any cloud emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'attacker': None} CanCreateWorkloadAs {'identity': None}

emit

source type	`Identity`
target type	`Identity`
source	`?attacker`
target	`?identity`
state logic	ACTIVE

Raw rule rules/derived/can-execute-as.yaml

id: execute-as-via-new-workload
emits: CanExecuteAs
description: Create a new workload and attach a privileged identity to it.
applies_to:
- '*'
match:
- - attacker: null
  - CanCreateWorkloadAs
  - identity: null
emit:
  source_type: Identity
  target_type: Identity
  source: ?attacker
  target: ?identity
  state_logic: ACTIVE
  derived_from:
  - ?attacker CanCreateWorkloadAs ?identity