agentsclimarketplace

Detecting aws iam privilege escalation

Skill Mikaru0Mystic/sectinel/arsenal/Anthropic-Cybersecurity-Skills/skills/detecting-aws-iam-privilege-escalation

Open-source security arsenal for AI coding agents: 784 cybersecurity skills, scanner integrations, and a security MCP for Claude Code, Cursor, opencode, Gemini CLI, Cline, and any agentskills.io agent. Mapped to OWASP, MITRE ATT&CK, NIST CSF, D3FEND, ATLAS.

Install
npx -y skills add Mikaru0Mystic/sectinel --skill detecting-aws-iam-privilege-escalation

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 11 stars11 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violations

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.3 KB, as published. Nobody here has run it

Detecting AWS IAM Privilege Escalation

Overview

This skill uses boto3 and Cloudsplaining-style analysis to identify IAM privilege escalation paths in AWS accounts. It downloads the account authorization details, analyzes each policy for dangerous permission combinations (iam:PassRole + lambda:CreateFunction, iam:CreatePolicyVersion, sts:AssumeRole), and flags policies that violate least-privilege principles.

When to Use

  • When investigating security incidents that require detecting aws iam privilege escalation
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Python 3.8+ with boto3 library
  • AWS credentials with IAM read-only access (iam:GetAccountAuthorizationDetails)
  • Optional: cloudsplaining Python package for HTML report generation

Steps

  1. Download IAM Authorization Details — Call iam:GetAccountAuthorizationDetails to retrieve all users, groups, roles, and policies
  2. Analyze Policies for Privilege Escalation — Check each policy for known escalation permission combinations
  3. Identify Wildcard Resource Policies — Flag policies using Resource: "*" with dangerous actions
  4. Map Principal-to-Policy Relationships — Build a graph of which principals can access which escalation paths
  5. Score and Prioritize Findings — Rank findings by severity based on escalation vector type
  6. Generate Report — Produce structured JSON report with remediation guidance

Expected Output

  • JSON report of privilege escalation findings with severity scores
  • List of dangerous permission combinations per principal
  • Wildcard resource policy audit results
  • Remediation recommendations for each finding

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.