💻 computer science

TAC: Hybrid IAM Privilege Escalation Detection

The paper presents TAC, a novel hybrid IAM privilege escalation detection framework for AWS that combines a comprehensive whitebox detector with an innovative, reinforcement-learning-driven greybox approach to identify permission flow-based attacks while respecting customer privacy constraints.

Original authors: Yang Hu, Wenxi Wang, Sarfraz Khurshid, Mohit Tiwari

Published 2026-07-24

📖 3 min read☕ Coffee break read

CC BY 4.0

Original authors: Yang Hu, Wenxi Wang, Sarfraz Khurshid, Mohit Tiwari

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the internet as a giant, bustling city where every building, bank, and secret vault is protected by a digital doorman. This doorman is called Identity and Access Management, or IAM for short. Its job is simple but critical: it decides who gets to walk through which doors. If the doorman makes a mistake—like giving a janitor the keys to the CEO's safe or letting a delivery driver open the bank vault—that's a "misconfiguration." In the world of cloud computing, these mistakes are like leaving the front door wide open for thieves, leading to data breaches and stolen secrets. For years, security experts have built tools to check these doormen, but they've faced two big problems: their tools only know how to spot a few specific types of mistakes, and they demand to see the entire, secret list of keys and rules before they can even start looking. This means many dangerous mistakes slip through the cracks, and companies are often too scared to share their full security blueprints with outsiders.

Enter a new team of researchers who built a smarter, more flexible security guard named TAC. Think of TAC as a hybrid detective that can work in two different modes. First, there's TAC-WB, the "Whitebox" detective. This one is like a master locksmith who gets to see every single blueprint, key, and rule in the building. By studying over 14,000 different ways permissions can be passed around, TAC-WB created a massive "cheat sheet" of 219 different ways a thief could sneak in. It uses this sheet to trace every possible path a permission could take, ensuring it catches every type of privilege escalation, even the tricky ones other tools miss.

But what if the building owner refuses to hand over the blueprints? That's where TAC-GB, the "Greybox" detective, comes in. This is the paper's real magic trick. Instead of demanding the whole map, TAC-GB plays a smart game of "20 Questions." It looks at the parts of the map the owner is willing to share and then asks very specific, targeted questions like, "Does this user have this specific key?" The owner can say "Yes," "No," or "I'd rather not say." TAC-GB is so clever that it uses a special kind of artificial intelligence (a brain that learns from graphs) to figure out exactly which questions will reveal the most secrets with the fewest tries. It's like a detective who knows exactly which door to knock on to find the thief, rather than knocking on every door in the neighborhood.

The researchers tested their new detectives against a mountain of fake and real-world security puzzles. They built a giant practice ground called TAC-Bench with 2,500 different scenarios to make sure their tools were ready for the real thing. The results were impressive: the Whitebox detective found every single mistake, including real-world attacks that caused massive data leaks, while older tools failed to spot them. Even more surprisingly, the Greybox detective, working with only partial information and asking just a handful of questions, performed almost as well as the tools that saw everything. It proved that you don't need to see the whole secret to catch the thief; you just need to ask the right questions. This new approach offers a way for companies to keep their secrets safe while still getting top-tier security checks, changing the game from "show us everything or nothing" to a smart, privacy-friendly partnership.

Technical Summary: TAC: Hybrid IAM Privilege Escalation Detection

Problem Statement

Identity and Access Management (IAM) misconfigurations are a primary vector for privilege escalation (PE) attacks in cloud environments, leading to data breaches and significant economic losses. Existing detection tools face two critical limitations:

Limited PE Coverage: Current detectors (e.g., Pacu, PMapper, Cloudsplaining) cover only a small subset of PE types. They often rely on fixed catalogs of known attack patterns or model only specific entity relationships (e.g., user-role chains), leaving large portions of the attack surface undetected.
Requirement for Full Configuration Access: All existing detectors operate as "whitebox" tools, requiring full access to an organization's IAM configuration. This creates a barrier for third-party security services, as customers in sensitive sectors (finance, healthcare, government) are often unwilling to disclose complete configurations due to privacy concerns and the risk of exposing sensitive organizational details.

Methodology

The authors propose TAC, the first hybrid framework supporting both whitebox and greybox analysis for AWS IAM. The core innovation is a systematic abstraction of permission acquisition as permission flows.

1. Systematic Study and Abstraction

The authors conducted a systematic review of over 14,000 AWS-supported operations and identified five distinct PE categories:

Permission Request: Directly requesting additional permissions (e.g., iam:AttachUserPolicy).
Permission Delegation: Using an entity as a delegate to grant permissions to another (e.g., cloudformation:UpdateStack).
Permission Inheritance: Acquiring permissions via group membership or role assumption.
Code Execution: Executing code under a different security context (e.g., lambda:UpdateFunctionCode).
Credential Takeover: Creating or resetting credentials to act as another entity (e.g., iam:CreateAccessKey).

From this study, the authors manually extracted 219 permission flow templates that map source-sink entity type pairs to the operations enabling permission propagation.

2. TAC-WB (Whitebox Detector)

TAC-WB achieves comprehensive coverage by modeling IAM configurations as a Permission Flow Graph (PFG).

Graph Construction: Nodes represent entities and permissions; edges represent permission flows (enabled or disabled).
Semantic Representation: The system applies a domain-specific fixed-point analysis to iteratively propagate permissions along enabled flows until a stable state is reached.
Detection: A PE is reported only if the untrusted entity can reach the target permission through a concrete sequence of propagations. This ensures precision by construction, guaranteeing that every reported PE corresponds to a valid escalation path.

3. TAC-GB (Greybox Detector)

TAC-GB addresses the privacy barrier by operating on partial configurations where customers selectively disclose entities and answer queries about permission assignments.

Partial PFG: The graph is extended to include visibility states (? for unknown, + for confirmed, * for unknown flow, ⊕ for confirmed flow).
Interactive Query Mechanism: The system dynamically selects queries (e.g., "Is permission $p$ assigned to entity $e$ ?") based on the current partial state.
Reinforcement Learning (RL) Optimization: To minimize customer interaction, TAC-GB employs an RL agent with a Graph Neural Network (GNN) query model. The agent learns to select the most informative queries to reach a terminal state (PE detection) with the fewest steps.
Offline Pretraining: To handle the "cold start" problem and avoid negative transfer, the GNN models are pre-trained offline on a diverse set of PE tasks, partitioned by untrusted entity type.

4. TAC-Bench (Benchmark Dataset)

To support training and evaluation, the authors constructed TAC-Bench, the first comprehensive IAM PE benchmark.

Scale: Contains 2,500 tasks, averaging 137 entities and 1,282 permissions, closely matching real-world enterprise complexity.
Generation: Tasks are synthesized via a three-stage LLM pipeline (context generation, PE generation based on documented techniques, and Chain-of-Thought verification) and manually validated to ensure valid escalation paths.

Key Contributions

Systematic Study: Identification of five PE categories and the revelation that existing tools systematically fail to cover large portions of the attack surface.
TAC-WB: A whitebox detector achieving 100% coverage of the five PE categories via 219 permission flow templates and fixed-point analysis.
TAC-GB: The first greybox PE detector, enabling detection from partial configurations through interactive, RL-guided queries while maintaining precision.
TAC-Bench: A large-scale, diverse benchmark (2,500 tasks) designed to mimic real-world misconfigurations, addressing the lack of suitable public datasets.

Experimental Results

Experiments were conducted on synthetic (TAC-Bench), public (IAM Vulnerable), and real-world (Startup) benchmarks.

Whitebox Effectiveness: TAC-WB achieved a 0% False Negative Rate (FNR) across all test sets, detecting all PEs missed by state-of-the-art tools (Pacu, Cloudsplaining, PMapper), including real-world enterprise escalations where existing tools failed completely (100% FNR for baselines).
Whitebox Efficiency: TAC-WB maintained practical runtimes (often under 1 second), comparable to or faster than the best-performing baseline (PMapper) despite its broader coverage.
Greybox Effectiveness: TAC-GB significantly outperformed all greybox variants (random selection, evolutionary algorithms, no pretraining). Under modest query budgets (e.g., 100 queries), TAC-GB achieved an FNR of 27% on synthetic data, rivaling whitebox baselines that require full access. On real-world tasks, TAC-GB was the only detector to successfully identify PEs.
Greybox Efficiency: TAC-GB required an average of only 19 queries to detect a PE, demonstrating high query efficiency and stability compared to ablation variants.

Significance and Claims

The paper claims that TAC represents a fundamental shift in IAM security analysis:

Comprehensive Coverage: By moving from ad-hoc pattern matching to a systematic permission flow abstraction, TAC-WB eliminates the coverage gaps inherent in current tools.
Privacy-Preserving Security: TAC-GB demonstrates that high-fidelity PE detection is possible without full configuration disclosure, transforming security auditing from an "all-or-nothing" disclosure model to a graduated, privacy-preserving engagement.
Neuro-Symbolic Architecture: The framework successfully combines formal analysis (fixed-point logic for soundness) with data-driven optimization (RL/GNN for efficiency), offering a reusable design pattern for software engineering tools that require both correctness guarantees and adaptability.
Extensibility: While currently targeting AWS IAM, the authors assert the architecture is platform-agnostic and can be extended to other cloud providers (e.g., Azure, Google Cloud) and domains by extracting new permission flow templates.