impersonate-is-escalation

Impersonating a strictly-more-privileged identity is privilege escalation.

derived any cloud emits CanEscalateTo

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanImpersonate {'identity': None}

where

privilege(?identity) > privilege(?principal)

emit

source typeIdentity
target typeIdentity
source?principal
target?identity
state logicinherit from CanImpersonate: if the impersonation is CONDITIONAL(key_permission)/POTENTIAL/BLOCKED, the escalation carries the same state and gating condition. Only ACTIVE when the underlying CanImpersonate is ACTIVE.

Narrative

{principal.name} can escalate to {identity.name} by impersonating it - it can act as {identity.name}, which holds strictly greater privilege.

Raw rule rules/derived/credential-chains.yaml

id: impersonate-is-escalation
emits: CanEscalateTo
description: Impersonating a strictly-more-privileged identity is privilege escalation.
applies_to:
- '*'
match:
- - principal: null
  - CanImpersonate
  - identity: null
where:
- privilege(?identity) > privilege(?principal)
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?identity
  permissions: []
  state_logic: 'inherit from CanImpersonate: if the impersonation is CONDITIONAL(key_permission)/POTENTIAL/BLOCKED,
    the escalation carries the same state and gating condition. Only ACTIVE when the underlying CanImpersonate
    is ACTIVE.'
  confidence: min(contributing_confidences)
  derived_from:
  - ?principal CanImpersonate ?identity
  false_positive_note: "Only emit when the target identity is STRICTLY more privileged than the principal;\
    \ a lateral, same-privilege impersonation is credential access but not escalation. Privilege comparison\
    \ must use the resolved effective privilege of both identities (accounting for group/role membership),\
    \ not a static label. Inherits state from the CanImpersonate input \u2014 never upgrade."
  narrative: "{principal.name} can escalate to {identity.name} by impersonating it \u2014 it can act as\
    \ {identity.name}, which holds strictly greater privilege."
move · open · esc close