diff --git a/src/privilege-escalation-paths/aws/_excluded_artifact_join_strict_reaudit_20261016.yaml b/src/privilege-escalation-paths/aws/_excluded_artifact_join_strict_reaudit_20261016.yaml index 8f40efbf50..dc67d85149 100644 --- a/src/privilege-escalation-paths/aws/_excluded_artifact_join_strict_reaudit_20261016.yaml +++ b/src/privilege-escalation-paths/aws/_excluded_artifact_join_strict_reaudit_20261016.yaml @@ -74,6 +74,7 @@ artifact alone cannot establish a principal-to-principal path.' prior_id: aws-elasticbeanstalk-rebuildenvironment-s3-code - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codeartifact-privesc/README.md#publish-a-newer-compatible-package-version + historical_source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codeartifact-post-exploitation/README.md#publish-a-newer-compatible-package-version source_revision: b587e6bd26 technique: Publish a newer compatible version of a trusted CodeArtifact package consumed by a privileged workload diff --git a/src/privilege-escalation-paths/aws/_excluded_consumer_input_join_strict_reaudit_20261016.yaml b/src/privilege-escalation-paths/aws/_excluded_consumer_input_join_strict_reaudit_20261016.yaml index f20743f3b2..791be86d21 100644 --- a/src/privilege-escalation-paths/aws/_excluded_consumer_input_join_strict_reaudit_20261016.yaml +++ b/src/privilege-escalation-paths/aws/_excluded_consumer_input_join_strict_reaudit_20261016.yaml @@ -126,6 +126,7 @@ gain.' prior_id: aws-codecommit-gitpush-pipeline-source-cloudformation-role - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codecommit-pipeline-source-privesc/README.md#push-a-codecommit-source-revision-executed-by-a-codebuild-project + historical_source: src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-codebuild-unauthenticated-access/README.md#buildspecyml source_revision: b587e6bd26 technique: Push a CodeCommit source revision executed by a CodeBuild project reason: 'The codecommit:GitPush source operation is not joined to an exact consumed input and diff --git a/src/privilege-escalation-paths/aws/_excluded_secondary_bounded_role_overclaim_20261016.yaml b/src/privilege-escalation-paths/aws/_excluded_secondary_bounded_role_overclaim_20261016.yaml index 0d13612127..3578b2bec7 100644 --- a/src/privilege-escalation-paths/aws/_excluded_secondary_bounded_role_overclaim_20261016.yaml +++ b/src/privilege-escalation-paths/aws/_excluded_secondary_bounded_role_overclaim_20261016.yaml @@ -1,5 +1,6 @@ # Additional role targets whose service execution is bounded by a fixed configuration or file/SQL session. - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-appsync-privesc/README.md#hijack-resolver-function-or-data-source-behavior + historical_source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-appsync-post-exploitation/README.md#hijack-resolver-function-or-data-source-behavior technique: aws-appsync-updateresolver-existing-datasource-role reason: Only HTTP data sources with IAM authorization can sign arbitrary AWS API calls. This entry targets every existing AppSync data-source role, including DynamoDB/OpenSearch/RDS/EventBridge backends whose role use is diff --git a/src/privilege-escalation-paths/aws/_excluded_uncollected_service_join_final_reaudit_20261016.yaml b/src/privilege-escalation-paths/aws/_excluded_uncollected_service_join_final_reaudit_20261016.yaml index 64b0c7bd29..eec8f20c6a 100644 --- a/src/privilege-escalation-paths/aws/_excluded_uncollected_service_join_final_reaudit_20261016.yaml +++ b/src/privilege-escalation-paths/aws/_excluded_uncollected_service_join_final_reaudit_20261016.yaml @@ -41,6 +41,7 @@ conditional route is excluded from the automatic principal graph. prior_id: aws-ecs-capacity-provider-hijack - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mwaa-privesc/README.md#classic-mwaa-airflowcreateweblogintoken--airflowcreateclitoken--code-execution-as-the-environment-execution-role + historical_source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-mwaa-post-exploitation/README.md#classic-mwaa-airflowcreateweblogintoken--airflowcreateclitoken--code-execution-as-the-environment-execution-role source_revision: b587e6bd26 technique: Mint an Airflow CLI token for an MWAA environment and run code as its execution role reason: CreateCliToken grants a CLI session for one MWAA environment, but that session does not @@ -49,6 +50,7 @@ code or code-bearing input the source controls. Those Airflow and DAG facts are not collected. prior_id: aws-mwaa-createclitoken-execution-role - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mwaa-privesc/README.md#classic-mwaa-airflowcreateweblogintoken--airflowcreateclitoken--code-execution-as-the-environment-execution-role + historical_source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-mwaa-post-exploitation/README.md#classic-mwaa-airflowcreateweblogintoken--airflowcreateclitoken--code-execution-as-the-environment-execution-role source_revision: b587e6bd26 technique: Mint an Airflow web-login token for an MWAA environment and run code as its execution role diff --git a/src/privilege-escalation-paths/aws/_excluded_unjoined_subject_strict_reaudit_20261016.yaml b/src/privilege-escalation-paths/aws/_excluded_unjoined_subject_strict_reaudit_20261016.yaml index dad60afbec..1889a5f624 100644 --- a/src/privilege-escalation-paths/aws/_excluded_unjoined_subject_strict_reaudit_20261016.yaml +++ b/src/privilege-escalation-paths/aws/_excluded_unjoined_subject_strict_reaudit_20261016.yaml @@ -50,6 +50,7 @@ credential or exact permission-set assignment scope. prior_id: aws-identitystore-createuser-createaccountassignment - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-pca-connector-ad-privesc/README.md#pca-connector-adcreatetemplate--change-ad-certificate-enrollment-rules + historical_source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-pca-connector-ad-privesc/README.md#pca-connector-adcreatetemplate--publish-a-malicious-certificate-template-esc1--esc9 source_revision: 171e422299 technique: Publish a malicious certificate template through PCA Connector for AD and enroll as a domain admin @@ -57,6 +58,7 @@ certificate mapping authenticates as the exact directory admin. prior_id: aws-pca-connector-ad-createtemplate-esc1 - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-pca-connector-ad-privesc/README.md#pca-connector-adupdatetemplate--change-an-existing-certificate-template + historical_source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-pca-connector-ad-privesc/README.md#pca-connector-adupdatetemplate--weaken-an-existing-legitimate-template-in-place source_revision: 171e422299 technique: Weaken an existing PCA Connector for AD certificate template in place reason: Template update does not prove the source controls an enrollable AD identity or that