cartography 0.93.0rc1__py3-none-any.whl → 0.123.0__py3-none-any.whl

cartography/rules/cli.py

@@ -0,0 +1,261 @@
+"""
+Cartography RunRules CLI
+
+Execute security frameworks and present facts about your environment.
+"""
+
+import builtins
+import logging
+import os
+from enum import Enum
+from typing import Generator
+
+import typer
+from typing_extensions import Annotated
+
+from cartography.rules.data.rules import RULES
+from cartography.rules.runners import run_rules
+
+app = typer.Typer(
+    help="Execute Cartography security frameworks",
+    no_args_is_help=True,
+)
+
+
+class OutputFormat(str, Enum):
+    """Output format options."""
+
+    text = "text"
+    json = "json"
+
+
+# ----------------------------
+# Autocompletion functions
+# ----------------------------
+
+
+def complete_rules(incomplete: str) -> Generator[str, None, None]:
+    """Autocomplete rules names."""
+    for name in RULES.keys():
+        if name.startswith(incomplete):
+            yield name
+
+
+def complete_rules_with_all(incomplete: str) -> Generator[str, None, None]:
+    """Autocomplete rules names plus 'all'."""
+    for name in builtins.list(RULES.keys()) + ["all"]:
+        if name.startswith(incomplete):
+            yield name
+
+
+def complete_facts(
+    ctx: typer.Context, incomplete: str
+) -> Generator[tuple[str, str], None, None]:
+    """Autocomplete facts IDs with descriptions based on selected rule."""
+    rule = ctx.params.get("rule")
+    if not rule or rule not in RULES:
+        return
+
+    for fact in RULES[rule].facts:
+        if fact.id.lower().startswith(incomplete.lower()):
+            yield (fact.id, fact.name)
+
+
+# ----------------------------
+# CLI Commands
+# ----------------------------
+
+
+@app.command(name="list")  # type: ignore[misc]
+def list_cmd(
+    rule: Annotated[
+        str | None,
+        typer.Argument(
+            help="Rule name (e.g., mfa-missing)",
+            autocompletion=complete_rules,
+        ),
+    ] = None,
+) -> None:
+    """
+    List available rules and facts.
+
+    \b
+    Examples:
+        cartography-rules list
+        cartography-rules list mfa-missing
+        cartography-rules list mfa-missing missing-mfa-cloudflare
+    """
+    # List all frameworks
+    if not rule:
+        typer.secho("\nAvailable Rules\n", bold=True)
+        for rule_name, rule_obj in RULES.items():
+            typer.secho(f"{rule_name}", fg=typer.colors.CYAN)
+            typer.echo(f"  Name:         {rule_obj.name}")
+            typer.echo(f"  Version:      {rule_obj.version}")
+            typer.echo(f"  Facts:        {len(rule_obj.facts)}")
+            if rule_obj.references:
+                typer.echo("  References:")
+                for ref in rule_obj.references:
+                    typer.echo(f"    - [{ref.text}]({ref.url})")
+            typer.echo()
+        return
+
+    # Validate rule
+    if rule not in RULES:
+        typer.secho(f"Error: Unknown rule '{rule}'", fg=typer.colors.RED, err=True)
+        typer.echo(f"Available: {', '.join(RULES.keys())}", err=True)
+        raise typer.Exit(1)
+
+    rule_obj = RULES[rule]
+
+    typer.secho(f"\n{rule_obj.name}", bold=True)
+    typer.echo(f"ID:  {rule_obj.id}")
+    typer.secho(f"\nFacts ({len(rule_obj.facts)})\n", bold=True)
+
+    for fact in rule_obj.facts:
+        typer.secho(f"{fact.id}", fg=typer.colors.CYAN)
+        typer.echo(f"  Name:        {fact.name}")
+        typer.echo(f"  Description: {fact.description}")
+        typer.echo(f"  Maturity:    {fact.maturity.value}")
+        typer.echo(f"  Provider:    {fact.module.value}")
+        typer.echo()
+
+
+@app.command(name="run")  # type: ignore[misc]
+def run_cmd(
+    rule: Annotated[
+        str | None,
+        typer.Argument(
+            help="Specific rule ID to run",
+            autocompletion=complete_rules_with_all,
+        ),
+    ] = None,
+    fact: Annotated[
+        str | None,
+        typer.Argument(
+            help="Specific fact ID to run",
+            autocompletion=complete_facts,
+        ),
+    ] = None,
+    uri: Annotated[
+        str,
+        typer.Option(help="Neo4j URI", envvar="NEO4J_URI"),
+    ] = "bolt://localhost:7687",
+    user: Annotated[
+        str,
+        typer.Option(help="Neo4j username", envvar="NEO4J_USER"),
+    ] = "neo4j",
+    database: Annotated[
+        str,
+        typer.Option(help="Neo4j database name", envvar="NEO4J_DATABASE"),
+    ] = "neo4j",
+    neo4j_password_env_var: Annotated[
+        str | None,
+        typer.Option(help="Environment variable containing Neo4j password"),
+    ] = None,
+    neo4j_password_prompt: Annotated[
+        bool,
+        typer.Option(help="Prompt for Neo4j password interactively"),
+    ] = False,
+    output: Annotated[
+        OutputFormat,
+        typer.Option(help="Output format"),
+    ] = OutputFormat.text,
+    experimental: bool = typer.Option(
+        True,
+        "--experimental/--no-experimental",
+        help="Enable or disable experimental facts.",
+    ),
+) -> None:
+    """
+    Execute a security framework.
+
+    \b
+    Examples:
+        cartography-rules run all
+        cartography-rules run mfa-missing
+        cartography-rules run mfa-missing missing-mfa-cloudflare
+    """
+    # Validate rule
+    valid_rules = builtins.list(RULES.keys()) + ["all"]
+    if rule not in valid_rules:
+        typer.secho(f"Error: Unknown rule '{rule}'", fg=typer.colors.RED, err=True)
+        typer.echo(f"Available: {', '.join(valid_rules)}", err=True)
+        raise typer.Exit(1)
+
+    # Validate fact requires rule
+    if fact and not rule:
+        typer.secho(
+            "Error: Cannot specify fact without rule",
+            fg=typer.colors.RED,
+            err=True,
+        )
+        raise typer.Exit(1)
+
+    # Validate filtering with 'all'
+    if rule == "all" and fact:
+        typer.secho(
+            "Error: Cannot filter by fact when running all rules",
+            fg=typer.colors.RED,
+            err=True,
+        )
+        raise typer.Exit(1)
+
+    # Validate fact exists
+    if fact and rule != "all":
+        rule_obj = RULES[rule]
+        fact_obj = rule_obj.get_fact_by_id(fact)
+        if not fact_obj:
+            typer.secho(
+                f"Error: Fact '{fact}' not found in rule '{rule}'",
+                fg=typer.colors.RED,
+                err=True,
+            )
+            typer.echo("\nAvailable facts:", err=True)
+            for fa in rule_obj.facts:
+                typer.echo(f"  {fa.id}", err=True)
+            raise typer.Exit(1)
+
+    # Get password
+    password = None
+    if neo4j_password_prompt:
+        password = typer.prompt("Neo4j password", hide_input=True)
+    elif neo4j_password_env_var:
+        password = os.environ.get(neo4j_password_env_var)
+    else:
+        password = os.getenv("NEO4J_PASSWORD")
+        if not password:
+            password = typer.prompt("Neo4j password", hide_input=True)
+
+    # Determine rules to run
+    if rule == "all":
+        rules_to_run = builtins.list(RULES.keys())
+    else:
+        rules_to_run = [rule]
+
+    # Execute
+    try:
+        exit_code = run_rules(
+            rules_to_run,
+            uri,
+            user,
+            password,
+            database,
+            output.value,
+            fact_filter=fact,
+            exclude_experimental=not experimental,
+        )
+        raise typer.Exit(exit_code)
+    except KeyboardInterrupt:
+        raise typer.Exit(130)
+
+
+def main():
+    """Entrypoint for cartography-rules CLI."""
+    logging.basicConfig(level=logging.INFO)
+    logging.getLogger("neo4j").setLevel(logging.ERROR)
+    app()
+
+
+if __name__ == "__main__":
+    main()

cartography/rules/data/rules/__init__.py

@@ -0,0 +1,46 @@
+from cartography.rules.data.rules.cloud_security_product_deactivated import (
+    cloud_security_product_deactivated,
+)
+from cartography.rules.data.rules.compute_instance_exposed import (
+    compute_instance_exposed,
+)
+from cartography.rules.data.rules.database_instance_exposed import (
+    database_instance_exposed,
+)
+from cartography.rules.data.rules.delegation_boundary_modifiable import (
+    delegation_boundary_modifiable,
+)
+from cartography.rules.data.rules.identity_administration_privileges import (
+    identity_administration_privileges,
+)
+from cartography.rules.data.rules.inactive_user_active_accounts import (
+    inactive_user_active_accounts,
+)
+from cartography.rules.data.rules.malicious_npm_dependencies_shai_hulud import (
+    malicious_npm_dependencies_shai_hulud,
+)
+from cartography.rules.data.rules.mfa_missing import missing_mfa_rule
+from cartography.rules.data.rules.object_storage_public import object_storage_public
+from cartography.rules.data.rules.policy_administration_privileges import (
+    policy_administration_privileges,
+)
+from cartography.rules.data.rules.unmanaged_accounts import unmanaged_accounts
+from cartography.rules.data.rules.workload_identity_admin_capabilities import (
+    workload_identity_admin_capabilities,
+)
+
+# Rule registry - all available rules
+RULES = {
+    compute_instance_exposed.id: compute_instance_exposed,
+    database_instance_exposed.id: database_instance_exposed,
+    delegation_boundary_modifiable.id: delegation_boundary_modifiable,
+    identity_administration_privileges.id: identity_administration_privileges,
+    inactive_user_active_accounts.id: inactive_user_active_accounts,
+    missing_mfa_rule.id: missing_mfa_rule,
+    object_storage_public.id: object_storage_public,
+    policy_administration_privileges.id: policy_administration_privileges,
+    unmanaged_accounts.id: unmanaged_accounts,
+    workload_identity_admin_capabilities.id: workload_identity_admin_capabilities,
+    cloud_security_product_deactivated.id: cloud_security_product_deactivated,
+    malicious_npm_dependencies_shai_hulud.id: malicious_npm_dependencies_shai_hulud,
+}

cartography/rules/data/rules/cloud_security_product_deactivated.py

@@ -0,0 +1,49 @@
+from cartography.rules.spec.model import Fact
+from cartography.rules.spec.model import Finding
+from cartography.rules.spec.model import Maturity
+from cartography.rules.spec.model import Module
+from cartography.rules.spec.model import Rule
+
+# AWS
+aws_guard_duty_detector_disabled = Fact(
+    id="aws_guard_duty_detector_disabled",
+    name="GuardDuty Detector Disabled",
+    description="Finds regions where GuardDuty Detector is disabled.",
+    cypher_query="""
+    MATCH (a:AWSAccount)-[:RESOURCE]-(r:EC2Instance|EKSCluster|AWSLambda|ECSCluster|RDSInstance|RDSCluster)
+    WHERE NOT EXISTS {
+        MATCH (a)-[:RESOURCE]->(d:GuardDutyDetector{status: "ENABLED"})
+        WHERE d.region = r.region
+    }
+    RETURN DISTINCT r.region AS region, a.name AS account_name, a.id AS account_id
+    ORDER BY r.region, a.name
+    """,
+    cypher_visual_query="""
+    MATCH (a:AWSAccount)-[:RESOURCE]-(r:EC2Instance|EKSCluster|AWSLambda|ECSCluster|RDSInstance|RDSCluster)
+    WHERE NOT EXISTS {
+        MATCH (a)-[:RESOURCE]->(d:GuardDutyDetector{status: "ENABLED"})
+        WHERE d.region = r.region
+    }
+    RETURN *
+    """,
+    module=Module.AWS,
+    maturity=Maturity.EXPERIMENTAL,
+)
+
+
+# Rule
+class CloudSecurityProductDeactivated(Finding):
+    region: str | None = None
+    account_name: str | None = None
+    account_id: str | None = None
+
+
+cloud_security_product_deactivated = Rule(
+    id="cloud_security_product_deactivated",
+    name="Cloud Security Product Deactivated",
+    description="Detects accounts (or regions) where cloud security products are deactivated.",
+    output_model=CloudSecurityProductDeactivated,
+    tags=("cloud_security",),
+    facts=(aws_guard_duty_detector_disabled,),
+    version="0.1.0",
+)

cartography/rules/data/rules/compute_instance_exposed.py

@@ -0,0 +1,51 @@
+from cartography.rules.spec.model import Fact
+from cartography.rules.spec.model import Finding
+from cartography.rules.spec.model import Maturity
+from cartography.rules.spec.model import Module
+from cartography.rules.spec.model import Rule
+
+# AWS Facts
+_aws_ec2_instance_internet_exposed = Fact(
+    id="aws_ec2_instance_internet_exposed",
+    name="Internet-Exposed EC2 Instances on Common Management Ports",
+    description=(
+        "EC2 instances exposed to the internet on ports 22, 3389, 3306, 5432, 6379, 9200, 27017"
+    ),
+    cypher_query="""
+    MATCH (a:AWSAccount)-[:RESOURCE]->(ec2:EC2Instance)-[:MEMBER_OF_EC2_SECURITY_GROUP]->(sg:EC2SecurityGroup)<-[:MEMBER_OF_EC2_SECURITY_GROUP]-(rule:IpPermissionInbound)
+    MATCH (rule)<-[:MEMBER_OF_IP_RULE]-(ip:IpRange{range:'0.0.0.0/0'})
+    WHERE rule.fromport IN [22, 3389, 3306, 5432, 6379, 9200, 27017]
+    RETURN a.id as account_id, a.name AS account, ec2.instanceid AS instance_id, rule.fromport AS port, sg.groupid AS security_group order by account, instance_id, port, security_group
+    """,
+    cypher_visual_query="""
+    MATCH p=(a:AWSAccount)-[:RESOURCE]->(ec2:EC2Instance)-[:MEMBER_OF_EC2_SECURITY_GROUP]->(sg:EC2SecurityGroup)<-[:MEMBER_OF_EC2_SECURITY_GROUP]-(rule:IpPermissionInbound)
+    MATCH p2=(rule)<-[:MEMBER_OF_IP_RULE]-(ip:IpRange{range:'0.0.0.0/0'})
+    WHERE rule.fromport IN [22, 3389, 3306, 5432, 6379, 9200, 27017]
+    RETURN *
+    """,
+    module=Module.AWS,
+    maturity=Maturity.EXPERIMENTAL,
+)
+
+
+# Rule
+class ComputeInstanceExposed(Finding):
+    instance: str | None = None
+    instance_id: str | None = None
+    account: str | None = None
+    account_id: str | None = None
+    port: int | None = None
+    security_group: str | None = None
+
+
+compute_instance_exposed = Rule(
+    id="compute_instance_exposed",
+    name="Internet-Exposed Compute Instances on Common Management Ports",
+    description=(
+        "Compute instances exposed to the internet on ports 22, 3389, 3306, 5432, 6379, 9200, 27017"
+    ),
+    output_model=ComputeInstanceExposed,
+    facts=(_aws_ec2_instance_internet_exposed,),
+    tags=("infrastructure", "compute", "attack_surface"),
+    version="0.1.0",
+)

cartography/rules/data/rules/database_instance_exposed.py

@@ -0,0 +1,53 @@
+from cartography.rules.spec.model import Fact
+from cartography.rules.spec.model import Finding
+from cartography.rules.spec.model import Maturity
+from cartography.rules.spec.model import Module
+from cartography.rules.spec.model import Rule
+
+# AWS Facts
+_aws_rds_public_access = Fact(
+    id="aws_rds_public_access",
+    name="Internet-Accessible RDS Database Attack Surface",
+    description="AWS RDS instances accessible from the internet",
+    cypher_query="""
+    MATCH (rds:RDSInstance)
+    WHERE rds.publicly_accessible = true
+    RETURN rds.id AS id,
+        rds.engine AS engine,
+        rds.db_instance_class AS instance_class,
+        rds.endpoint_address AS host,
+        rds.endpoint_port AS port,
+        rds.region AS region,
+        rds.storage_encrypted AS encrypted
+    """,
+    cypher_visual_query="""
+    MATCH p1=(rds:RDSInstance{publicly_accessible: true})
+    OPTIONAL MATCH p2=(rds)-[:MEMBER_OF_EC2_SECURITY_GROUP]->(sg:EC2SecurityGroup)
+    OPTIONAL MATCH p3=(rds)-[:MEMBER_OF_EC2_SECURITY_GROUP]->(sg:EC2SecurityGroup)<-[:MEMBER_OF_EC2_SECURITY_GROUP]-(rule:IpPermissionInbound:IpRule)
+    OPTIONAL MATCH p4=(rds)-[:MEMBER_OF_EC2_SECURITY_GROUP]->(sg:EC2SecurityGroup)<-[:MEMBER_OF_EC2_SECURITY_GROUP]-(rule:IpPermissionInbound:IpRule)<-[:MEMBER_OF_IP_RULE]-(ip:IpRange)
+    RETURN *
+    """,
+    module=Module.AWS,
+    maturity=Maturity.EXPERIMENTAL,
+)
+
+
+# Rule
+class DatabaseInstanceExposed(Finding):
+    host: str | None = None
+    id: str | None = None
+    engine: str | None = None
+    port: int | None = None
+    region: str | None = None
+    encrypted: bool | None = None
+
+
+database_instance_exposed = Rule(
+    id="database_instance_exposed",
+    name="Internet-Exposed Databases",
+    description=("Database instances accessible from the internet"),
+    output_model=DatabaseInstanceExposed,
+    facts=(_aws_rds_public_access,),
+    tags=("infrastructure", "databases", "attack_surface"),
+    version="0.1.0",
+)

cartography/rules/data/rules/delegation_boundary_modifiable.py

@@ -0,0 +1,90 @@
+from cartography.rules.spec.model import Fact
+from cartography.rules.spec.model import Finding
+from cartography.rules.spec.model import Maturity
+from cartography.rules.spec.model import Module
+from cartography.rules.spec.model import Rule
+
+# AWS
+_aws_trust_relationship_manipulation = Fact(
+    id="aws_trust_relationship_manipulation",
+    name="Roles with Cross-Account Trust Relationship Modification Capabilities",
+    description=(
+        "AWS IAM principals with permissions to modify role trust policies "
+        "(specifically AssumeRolePolicyDocuments)."
+    ),
+    cypher_query="""
+        MATCH (a:AWSAccount)-[:RESOURCE]->(principal:AWSPrincipal)
+        MATCH (principal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {effect:"Allow"})
+        WHERE NOT principal.name STARTS WITH 'AWSServiceRole'
+        AND NOT principal.name CONTAINS 'QuickSetup'
+        AND principal.name <> 'OrganizationAccountAccessRole'
+        WITH a, principal, policy, stmt,
+            [label IN labels(principal) WHERE label <> 'AWSPrincipal'][0] AS principal_type,
+            ['iam:UpdateAssumeRolePolicy', 'iam:CreateRole'] AS patterns
+        // Filter for matching Allow actions
+        WITH a, principal, principal_type, stmt, policy,
+            [action IN stmt.action
+                WHERE ANY(p IN patterns WHERE action = p)
+                OR action = 'iam:*'
+                OR action = '*'
+            ] AS matched_allow_actions
+        WHERE size(matched_allow_actions) > 0
+        // Look for any explicit Deny statement on same principal that matches those actions
+        OPTIONAL MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(deny_stmt:AWSPolicyStatement {effect:"Deny"})
+        WHERE ANY(action IN deny_stmt.action
+                WHERE action IN matched_allow_actions
+                    OR action = 'iam:*'
+                    OR action = '*')
+        // Exclude principals with an explicit Deny that overlaps
+        WITH a, principal, principal_type, policy, stmt, matched_allow_actions, deny_stmt
+        WHERE deny_stmt IS NULL
+        UNWIND matched_allow_actions AS action
+        RETURN DISTINCT
+            a.name AS account,
+            a.id AS account_id,
+            principal.name AS principal_name,
+            principal.arn AS principal_identifier,
+            policy.name AS policy_name,
+            principal_type,
+            collect(DISTINCT action) AS actions,
+            stmt.resource AS resources
+        ORDER BY account, principal_name
+    """,
+    cypher_visual_query="""
+        MATCH p = (a:AWSAccount)-[:RESOURCE]->(principal:AWSPrincipal)
+        MATCH p1 = (principal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement)
+        MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement)
+        WHERE NOT principal.name STARTS WITH 'AWSServiceRole'
+        AND principal.name <> 'OrganizationAccountAccessRole'
+        AND stmt.effect = 'Allow'
+        RETURN *
+    """,
+    module=Module.AWS,
+    maturity=Maturity.EXPERIMENTAL,
+)
+
+
+# Rule
+class DelegationBoundaryModifiable(Finding):
+    principal_name: str | None = None
+    principal_identifier: str | None = None
+    principal_type: str | None = None
+    account: str | None = None
+    account_id: str | None = None
+    policy_name: str | None = None
+    actions: list[str] = []
+    resources: list[str] = []
+
+
+delegation_boundary_modifiable = Rule(
+    id="delegation_boundary_modifiable",
+    name="Delegation Boundary Modifiable",
+    description=(
+        "Principals can edit role trust/assume policies or create roles with arbitrary trust—"
+        "allowing cross-account or lateral impersonation paths."
+    ),
+    output_model=DelegationBoundaryModifiable,
+    facts=(_aws_trust_relationship_manipulation,),
+    tags=("iam", "privilege_escalation"),
+    version="0.1.0",
+)

cartography/rules/data/rules/identity_administration_privileges.py

@@ -0,0 +1,100 @@
+from cartography.rules.spec.model import Fact
+from cartography.rules.spec.model import Finding
+from cartography.rules.spec.model import Maturity
+from cartography.rules.spec.model import Module
+from cartography.rules.spec.model import Rule
+
+# AWS
+_aws_account_manipulation_permissions = Fact(
+    id="aws_account_manipulation_permissions",
+    name="IAM Principals with Account Creation and Modification Permissions",
+    description=(
+        "AWS IAM users and roles with permissions to create, modify, or delete IAM "
+        "accounts and their associated policies."
+    ),
+    cypher_query="""
+        MATCH (a:AWSAccount)-[:RESOURCE]->(principal:AWSPrincipal)
+        MATCH (principal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement)
+        WHERE NOT principal.name STARTS WITH 'AWSServiceRole'
+        AND NOT principal.name CONTAINS 'QuickSetup'
+        AND principal.name <> 'OrganizationAccountAccessRole'
+        AND stmt.effect = 'Allow'
+        WITH a, principal, stmt, policy,
+            [label IN labels(principal) WHERE label <> 'AWSPrincipal'][0] AS principal_type,
+            [p IN ['iam:Create','iam:Attach','iam:Put','iam:Update','iam:Add'] | p] AS patterns
+        // Match only Allow statements whose actions fit the patterns
+        WITH a, principal, principal_type, stmt, policy,
+            [action IN stmt.action
+                WHERE ANY(prefix IN patterns WHERE action STARTS WITH prefix)
+                OR action = 'iam:*'
+                OR action = '*'
+            ] AS matched_allow_actions
+        WHERE size(matched_allow_actions) > 0
+        // Find explicit Deny statements for the same principal that overlap
+        OPTIONAL MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(deny_stmt:AWSPolicyStatement {effect:"Deny"})
+        WHERE ANY(deny_action IN deny_stmt.action
+                    WHERE deny_action IN matched_allow_actions
+                    OR deny_action = 'iam:*'
+                    OR deny_action = '*')
+        // If a deny exists, exclude those principals
+        WITH a, principal, principal_type, policy, stmt, matched_allow_actions, deny_stmt
+        WHERE deny_stmt IS NULL
+        UNWIND matched_allow_actions AS action
+        RETURN DISTINCT
+            a.name AS account,
+            a.id AS account_id,
+            principal.name AS principal_name,
+            principal.arn AS principal_identifier,
+            principal_type,
+            policy.name AS policy_name,
+            collect(DISTINCT action) AS actions,
+            stmt.resource AS resources
+        ORDER BY account, principal_name
+    """,
+    cypher_visual_query="""
+        MATCH p = (a:AWSAccount)-[:RESOURCE]->(principal:AWSPrincipal)
+        MATCH p1 = (principal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement)
+        WHERE NOT principal.name STARTS WITH 'AWSServiceRole'
+        AND NOT principal.name CONTAINS 'QuickSetup'
+        AND NOT principal.name = 'OrganizationAccountAccessRole'
+        AND stmt.effect = 'Allow'
+        AND ANY(action IN stmt.action WHERE
+            action STARTS WITH 'iam:Create'
+            OR action STARTS WITH 'iam:Attach'
+            OR action STARTS WITH 'iam:Put'
+            OR action STARTS WITH 'iam:Update'
+            OR action STARTS WITH 'iam:Add'
+            OR action = 'iam:*'
+            OR action = '*'
+        )
+        RETURN *
+    """,
+    module=Module.AWS,
+    maturity=Maturity.EXPERIMENTAL,
+)
+
+
+# Rule
+class IdentityAdministrationPrivileges(Finding):
+    principal_name: str | None = None
+    principal_identifier: str | None = None
+    account: str | None = None
+    account_id: str | None = None
+    principal_type: str | None = None
+    policy_name: str | None = None
+    actions: list[str] = []
+    resources: list[str] = []
+
+
+identity_administration_privileges = Rule(
+    id="identity_administration_privileges",
+    name="Identity Administration Privileges",
+    description=(
+        "Principals can create, attach, update, or otherwise administer identities "
+        "(users/roles/groups) and their bindings—classic escalation surface."
+    ),
+    output_model=IdentityAdministrationPrivileges,
+    facts=(_aws_account_manipulation_permissions,),
+    tags=("iam", "privilege_escalation"),
+    version="0.1.0",
+)