Merge pull request #10 from andoniaf/add-prowler-detection-coverage

Add Prowler detection coverage to 64 attack paths

Author: sethsec

README.md

@@ -2,9 +2,6 @@
 
 **The definitive source of truth for AWS IAM privilege escalation paths**
 
-[![Validate Schema](https://github.com/DataDog/pathfinding.cloud/actions/workflows/validate.yml/badge.svg)](https://github.com/DataDog/pathfinding.cloud/actions/workflows/validate.yml)
-[![Deploy to GitHub Pages](https://github.com/DataDog/pathfinding.cloud/actions/workflows/deploy.yml/badge.svg)](https://github.com/DataDog/pathfinding.cloud/actions/workflows/deploy.yml)
-
 **Website:** [https://pathfinding.cloud](https://pathfinding.cloud)
 
 ## Overview

data/paths/apprunner/apprunner-001.yaml

@@ -92,6 +92,8 @@ relatedPaths:
 - apprunner-002
 - lambda-001
 - ec2-001
+detectionTools:
+  prowler: https://github.com/prowler-cloud/prowler/blob/eabe4884379070c72e07103f239bac70d31f6320/prowler/providers/aws/services/iam/lib/privilege_escalation.py#L287
 toolSupport:
   pmapper: false
   iamVulnerable: false

data/paths/apprunner/apprunner-002.yaml

@@ -91,6 +91,8 @@ relatedPaths:
 - apprunner-001
 - lambda-003
 - glue-002
+detectionTools:
+  prowler: https://github.com/prowler-cloud/prowler/blob/eabe4884379070c72e07103f239bac70d31f6320/prowler/providers/aws/services/iam/lib/privilege_escalation.py#L292
 permissions:
   required:
   - permission: apprunner:UpdateService

data/paths/bedrock/bedrock-001.yaml

@@ -157,7 +157,7 @@ relatedPaths:
 - ec2-001
 - sagemaker-001
 detectionTools:
-  prowler: https://github.com/prowler-cloud/prowler/blob/49c75cc4180e2304747d8fe4bd1b16dd38929d07/prowler/providers/aws/services/iam/lib/privilege_escalation.py#L106
+  prowler: https://github.com/prowler-cloud/prowler/blob/eabe4884379070c72e07103f239bac70d31f6320/prowler/providers/aws/services/iam/lib/privilege_escalation.py#L294
 learningEnvironments:
   pathfinding-labs:
     type: open-source

data/paths/bedrock/bedrock-002.yaml

@@ -116,6 +116,8 @@ relatedPaths:
 - lambda-003
 - glue-002
 - ec2-002
+detectionTools:
+  prowler: https://github.com/prowler-cloud/prowler/blob/eabe4884379070c72e07103f239bac70d31f6320/prowler/providers/aws/services/iam/lib/privilege_escalation.py#L300
 permissions:
   required:
   - permission: bedrock-agentcore:StartCodeInterpreterSession

data/paths/cloudformation/cloudformation-001.yaml

@@ -85,7 +85,7 @@ relatedPaths:
 detectionTools:
   pmapper: https://github.com/nccgroup/PMapper/blob/91d2e60102bdadf346d77b60d90ddaa4a678f037/principalmapper/graphing/cloudformation_edges.py#L109-L132
   cloudsplaining: https://github.com/salesforce/cloudsplaining/blob/7f82e7ab0a1a714d20a69b1d0b892e4702754e6b/cloudsplaining/shared/constants.py#L152
-  prowler: https://github.com/prowler-cloud/prowler/blob/49c75cc4180e2304747d8fe4bd1b16dd38929d07/prowler/providers/aws/services/iam/lib/privilege_escalation.py#L60
+  prowler: https://github.com/prowler-cloud/prowler/blob/eabe4884379070c72e07103f239bac70d31f6320/prowler/providers/aws/services/iam/lib/privilege_escalation.py#L169
 learningEnvironments:
   pathfinding-labs:
     type: open-source

data/paths/cloudformation/cloudformation-002.yaml

@@ -187,6 +187,7 @@ learningEnvironments:
     description: Deploy Terraform into your own AWS account and practice individual exploitation paths (requires CloudFormation non-free module, ~$0.40/month)
 detectionTools:
   pmapper: https://github.com/nccgroup/PMapper/blob/91d2e60102bdadf346d77b60d90ddaa4a678f037/principalmapper/graphing/cloudformation_edges.py#L149
+  prowler: https://github.com/prowler-cloud/prowler/blob/eabe4884379070c72e07103f239bac70d31f6320/prowler/providers/aws/services/iam/lib/privilege_escalation.py#L174
 attackVisualization:
   nodes:
   - id: start

data/paths/cloudformation/cloudformation-003.yaml

@@ -5,6 +5,8 @@ services:
 - iam
 - cloudformation
 
+detectionTools:
+  prowler: https://github.com/prowler-cloud/prowler/blob/eabe4884379070c72e07103f239bac70d31f6320/prowler/providers/aws/services/iam/lib/privilege_escalation.py#L175
 permissions:
   required:
   - permission: iam:PassRole

data/paths/cloudformation/cloudformation-004.yaml

@@ -5,6 +5,8 @@ services:
 - iam
 - cloudformation
 
+detectionTools:
+  prowler: https://github.com/prowler-cloud/prowler/blob/eabe4884379070c72e07103f239bac70d31f6320/prowler/providers/aws/services/iam/lib/privilege_escalation.py#L181
 permissions:
   required:
   - permission: iam:PassRole

data/paths/cloudformation/cloudformation-005.yaml

@@ -172,6 +172,7 @@ relatedPaths:
 - cloudformation-004
 detectionTools:
   pmapper: https://github.com/nccgroup/PMapper/blob/91d2e60102bdadf346d77b60d90ddaa4a678f037/principalmapper/graphing/cloudformation_edges.py#L188-L210
+  prowler: https://github.com/prowler-cloud/prowler/blob/eabe4884379070c72e07103f239bac70d31f6320/prowler/providers/aws/services/iam/lib/privilege_escalation.py#L186
 learningEnvironments:
   pathfinding-labs:
     type: open-source