Datadog pathrunner: AWS IAM privilege escalation framework

What it is

pathrunner is a modular offensive framework from Datadog Security Labs that automates exploitation of the AWS IAM privilege escalation paths in pathfinding.cloud (released December 2025) and Pathfinding Labs (released May 2026). Documentation and the full command reference are at https://pathfinding.cloud/pathrunner/. As of October 2026 it has over 80 exploit modules. Datadog's stated purpose is to show which misconfigurations are actually exploitable, so defenders can prioritize remediation and build detections.

How it works

Identities are the core object, because cloud attacks mostly hop from one identity to another by obtaining credentials. A typical run imports a compromised IAM user, picks a module that identity has permission to run, picks the target identity, executes the attack and captures the target's credentials. pathrunner then imports and switches to those credentials automatically, and the operator confirms access to the target.

Each module offers several payloads. Datadog gives two reasons: some payloads fail under network restrictions or service control policies, and defenders can build detections for every payload instead of one post-exploitation action such as creating an admin user.

For attacker infrastructure, pathrunner can use a separate AWS account you control. Creating the EC2 instance deploys a second pathrunner on it, applies security groups, and shows SSH or SSM connection steps. A listener on that host then catches credentials from exploits run elsewhere.

What to do

Import and switch identities:

pathrunner identity add --from-clipboard
pathrunner identity switch [name]

Set up a remote credential catcher (three steps):

pathrunner attacker identity add
attacker infra ec2 create
attacker listener start

If pathrunner already runs on a host with open public callback ports, skip the deployment and run only attacker listener start.

Produce a defender handoff and clean up:

workspace report --output pathrunner.html
workspace cleanup all

The HTML report lists resources created or modified during the session. It also has a table of the CloudTrail events pathrunner is expected to have triggered, with timestamps and descriptions. For detection work, the page recommends running every payload in your environment and building a detection for each.

Caveats

The CloudTrail table lists events Datadog "thinks" pathrunner would trigger, so it is an expectation and not a verified log capture. The page gives no install steps, supported platforms or module list. Those are in the linked documentation and repo.