badzure-attack-authoring

name	badzure-attack-authoring
description	Authoring contract for a BadZure chained attack path as YAML (objective, initial_access, identities/resources, assignments, credentials, data_injects) that the deterministic reachability gate (`badzure check`) confirms is traversable. Use when designing or refining a multi-hop privilege-escalation path through a BadZure org baseline. Not for the org baseline itself.
user-invocable	false

BadZure attack authoring

A practical, condensed reference for authoring a chained BadZure attack path as YAML. Canonical sources: docs/attack-paths/chained.md, docs/configuration.md, and the worked example examples/chained/chained_apex.yml. When in doubt, read those.

This is for authorized lab tenants only. The whole point is a path that the reachability gate (badzure check) confirms is actually traversable, then deploys for training/detection.

---

The shape of a chained path

A path lives under attack_paths.<name> and uses assignments: (NOT privilege_escalation: — the two are mutually exclusive). It declares:

attack_paths:
  helpdesk_to_ga:
    objective:                       # the goal the path must REACH
      name: "Global Administrator via Key Vault"
      capability: entra_role         
          
       
                            
       
       [, , ]
                      
       
       
                          
              [{   }]
       [{   }, {   }]
             [{   }]
       [{   }]
    
       [{  ,   }]
            [{  ,   }]
                         
       {  ,  ,  ,   }
       {  ,  ,     ,   }
       {  ,  ,  ,
           ,   }
       {  ,  ,  ,   }
                         
       {  ,  ,   }
                        
       {  ,  ,  ,
           ,  ,
            }