A reference of AWS-native attack techniques the hackaws agent runs against your account, covering privilege escalation and credential access. Each page lists the required permissions, impact, detection, and mitigation.
An attacker with iam:PutRolePolicy writes an inline admin policy onto an IAM role, giving every principal that can assume the role full account access.
An attacker with iam:AttachRolePolicy attaches the AWS-managed AdministratorAccess policy to any IAM role.
An attacker with iam:PutUserPolicy writes an inline admin policy onto an IAM user, including the attacker's own user.
An attacker with iam:AttachUserPolicy attaches AdministratorAccess to any IAM user, including the attacker's own user.
An attacker with iam:PutGroupPolicy writes an inline admin policy onto an IAM group they belong to, escalating every user in that group.
An attacker with iam:AttachGroupPolicy attaches AdministratorAccess to a group they belong to, escalating every member of that group.
An attacker with iam:AddUserToGroup adds their user to a more privileged group, inheriting its policies.
An attacker with iam:CreatePolicyVersion uploads a new admin version of a customer-managed policy they already use and promotes it to default in a single API call, escalating every attached principal.
An attacker with iam:SetDefaultPolicyVersion switches a managed policy back to an older, broader version, escalating every attached principal.
An attacker with iam:SetDefaultPolicyVersion switches a managed policy to any older version that broadens their access, even when the switch strips permissions other attached principals rely on.
An attacker with iam:DeleteRolePermissionsBoundary removes the permissions boundary capping a role, so the role's identity policies take full effect.
An attacker with iam:DeleteUserPermissionsBoundary removes the permissions boundary capping a user, so the user's identity policies take full effect.
An attacker with iam:UpdateAssumeRolePolicy modifies a role's trust policy to let their current foothold assume it, reaching roles they could not reach before.
An attacker with iam:CreateAccessKey mints long-term CLI credentials for a more privileged user.
An attacker with iam:CreateLoginProfile sets a password on a programmatic-only user, then signs in to the console as that user.
An attacker with iam:UpdateLoginProfile resets a privileged user's console password, signs in as that user, and mints a long-term access key.
An attacker with lambda:CreateFunction and iam:PassRole creates a Lambda function with a privileged execution role and invokes it to run code as that role.
An attacker with lambda:UpdateFunctionConfiguration attaches a hostile layer to an existing function, running code with the function's execution role on the next invocation.
An attacker with Lambda read permissions reads every function's environment variables and extracts plaintext credentials.
An attacker with SSM read permissions reads every parameter in the account and extracts credentials from plaintext String values and decrypted SecureString values.
An attacker with Secrets Manager read permissions pulls every secret in the account.
An attacker with cloudformation:DescribeStacks reads every stack's outputs and parameters, which routinely contain plaintext credentials.
An attacker with ECS read permissions reads every task definition's container environment variables and extracts plaintext credentials.
An attacker with CodeBuild read permissions reads every project's plaintext environment variables and extracts credentials.