IAM-Deescalate: An Open Source Tool to Help Users Reduce the Risk of Privilege Escalation
Summary: Unit 42 researchers analyzed more than 680,000 identities across 18,000 cloud accounts from 200 organizations and found that 99% of cloud users, roles and service accounts are overly permissive. They released an open source tool, IAM-Deescalate, which uses PMapper to find non-administrator principals with a path to administrator and inserts inline deny policies to break those paths, remediating 24 of 31 (77%) known privilege escalation techniques in the IAM Vulnerable benchmark.
Key Takeaway: Nearly every identity in the studied cloud accounts carries more permission than it needs, and adversaries who obtain one can use it to escalate to Administrator. The tool closes 77% of known escalation techniques, leaving the remainder for someone to cover.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026