Hunting Shadow Admins in AWS
A tour of the AWS privilege escalation techniques modelled by PMapper and awspx, where each of them falls short, and how I rebuilt Snotra's shadow administrator detection to cover everything they do - and a good deal they do not.