“privilege-escalation”的搜索结果

Investigate excessive privileges inside Kubernetes pods by reviewing security settings, runtime events, and audit logs. Use admission policies to restrict risky configurations and Falco monitoring to detect suspicious privilege changes and container activity.

中文简介正在准备中。当前显示英语简介。

• Finding pods running as root or in privileged mode
• Reviewing host filesystem access and dangerous Linux permissions
• Detecting privilege changes while containers are running

Investigate attempts to gain higher privileges on Windows and Linux using endpoint and security logs. Guide hypothesis testing, evidence analysis, false-positive checks, and reporting to help assess suspicious privilege changes and the scope of a compromise.

中文简介正在准备中。当前显示英语简介。

• Hunting for signs of privilege escalation
• Investigating alerts about suspicious privilege changes
• Assessing compromise scope during incident response

Investigate suspicious privilege increases, including Windows UAC approval bypasses and Linux sudo or setuid abuse. Use registry changes, process relationships, and permission changes to identify possible abuse and document affected hosts, methods, and risk levels.

中文简介正在准备中。当前显示英语简介。

• Investigating Windows UAC bypass activity
• Tracing how administrative access was obtained
• Monitoring Linux sudo and setuid abuse

Analyze AWS IAM access policies with boto3 and Cloudsplaining-style checks to find permissions that could grant greater access. Produces a JSON report linking risky permissions to users or roles, with severity ratings and remediation guidance.

中文简介正在准备中。当前显示英语简介。

• Audit AWS IAM policies for excessive permissions
• Find permission combinations that enable privilege escalation
• Trace risky policies to affected users and roles

Audit Kubernetes access rules to find excessive permissions and service account token abuse paths. Trace which users or workloads could gain cluster administrator access, then produce prioritized findings and recommendations for reducing permissions.

中文简介正在准备中。当前显示英语简介。

• Reviewing Kubernetes privilege escalation paths
• Checking permissions after an RBAC change
• Tracing workloads with overprivileged service accounts

Identify and exploit misconfigured Identity and Access Management (IAM) permissions within Amazon Web Services (AWS) to escalate privileges. Use this skill to move from a low-privileged compromised IAM user/role (e.g., via SSRF) to full AdministratorAccess by abusing AssumeRole, PassRole, inline policies, or resource attachments.

中文简介正在准备中。当前显示原文说明。

Test AI agent systems for tool abuse, unauthorized actions, privilege escalation through tool chaining, and safety bypass via agentic workflows. Use this skill when assessing autonomous AI agents that use tool-calling (function calling, plugins, actions) to interact with external systems. Covers multi-step attack chains, implicit trust exploitation, and capability boundary testing for AI agents.

中文简介正在准备中。当前显示原文说明。

Detect privilege escalation attempts including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse across Windows and Linux.

中文简介正在准备中。当前显示原文说明。

Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.

中文简介正在准备中。当前显示原文说明。

Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violations

中文简介正在准备中。当前显示原文说明。

Find over-permissive RBAC roles and service-account token abuse paths in Kubernetes using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess during authorized cluster security reviews.

中文简介正在准备中。当前显示原文说明。

tespit etme
and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.

中文简介正在准备中。当前显示原文说明。

Performing authorized privilege escalation assessments in AWS environments to identify IAM misconfigurations that allow users or roles to elevate their permissions using Pacu, CloudFox, Principal Mapper, and manual IAM policy analysis techniques.

中文简介正在准备中。当前显示原文说明。

tespit etme
AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violations

中文简介正在准备中。当前显示原文说明。

Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.

中文简介正在准备中。当前显示原文说明。

Detect privilege escalation attempts including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse across Windows and Linux.

中文简介正在准备中。当前显示原文说明。

Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violations

中文简介正在准备中。当前显示原文说明。

Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.

中文简介正在准备中。当前显示原文说明。

Detect privilege escalation attempts including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse across Windows and Linux.

中文简介正在准备中。当前显示原文说明。

Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violations

中文简介正在准备中。当前显示原文说明。

Assess whether a container can escape its isolation and reach the host during an authorized security test. Review privileges, shared mounts, Docker socket exposure, and runC vulnerabilities, then document demonstrated impact and remediation.

中文简介正在准备中。当前显示英语简介。

• Testing container escape within an approved scope
• Assessing the impact of privileged or hostPath workloads
• Validating controls that block container escape

Use CloudFox to inspect AWS and Azure resources through read-only queries. Identify exposed endpoints, secrets, permissions, and role trust relationships, then organize findings into files for reviewing configuration weaknesses and potential paths to broader access.

中文简介正在准备中。当前显示英语简介。

• Inventorying an unfamiliar AWS or Azure account
• Finding internet-facing resources
• Mapping role trust relationships and permissions

Investigate service account misuse by examining unexpected interactive logons, privilege changes, and movement between systems. Correlate endpoint and security logs, distinguish suspicious activity from legitimate operations, and document evidence, risk, and recommended responses.

中文简介正在准备中。当前显示英语简介。

• Investigating unexpected interactive logons by service accounts
• Checking service account access outside its assigned scope
• Tracing suspicious movement between systems after hours

Investigate misuse of application identities in Microsoft Entra ID using audit and sign-in logs. Provides detection queries and investigation steps for suspicious credential additions, privileged role assignments, consent grants, and service principal enumeration.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious additions of application credentials
• Reviewing privileged roles assigned to application identities
• Building detection rules for Entra ID identity abuse