Datadog Pathrunner automates AWS IAM escalation to guide remediation priorities

Datadog Security Labs released Pathrunner, a cloud-native offensive security framework designed to automate the exploitation of AWS IAM privilege escalation paths. The tool helps security operations teams identify which misconfigurations are actually exploitable in their specific environments.

What happened

Datadog Security Labs published Pathrunner as a modular framework for automating the exploitation of AWS IAM privilege escalation techniques. This release follows the December 2025 launch of pathfinding.cloud, a catalog defining permission sets that allow one AWS IAM principal to access another. In May 2026, the team released Pathfinding Labs, which provided intentionally vulnerable environments for testing these techniques in a sandbox. Pathrunner connects these resources by automating the exploitation of the paths defined in the catalog and instantiated in the labs.

The framework is designed to help defenders triage security findings by demonstrating the actual impact of misconfigurations. According to Datadog, defenders often face more vulnerabilities than they can resolve, requiring careful prioritization of remediation efforts. By using an offensive tool to show how a misconfiguration can be exploited, teams can distinguish between exploitable flaws and missing best practices. This approach mirrors how software vulnerabilities are assessed, where the existence of publicly accessible proof-of-concept exploits increases the severity of related findings.

Pathrunner focuses on identities rather than network sessions, reflecting how attacks typically progress in cloud environments. While traditional on-premises Active Directory attacks often hop between workloads via TCP sessions, cloud attacks frequently move from one identity to another by accessing credentials. The tool allows users to import credentials for an AWS IAM user identity, select an exploit module, and target another identity. It then executes the attack, captures the target credentials, and automatically switches to the new identity to validate access.

Why it matters

The release addresses a gap in how cloud misconfigurations are evaluated compared to software vulnerabilities. Datadog notes that determining exploitability for misconfigurations is difficult without seeing the actual attack path. Tools like Metasploit and Bloodhound are widely used for offensive security in traditional environments, but Pathrunner adapts this approach for cloud-native identity-based attacks. By automating the process of hopping between identities, the framework provides a clear demonstration of risk that can justify remediation efforts to stakeholders.

The tool’s design reflects the reality that cloud attacks often do not involve workloads at all. Penetration testers and real attackers frequently pivot by accessing credentials directly, sometimes without executing code on a remote server. Pathrunner’s ability to import identities from multiple text-based formats and switch between them simplifies the simulation of these lateral movement techniques. This allows security teams to test their environments against known escalation paths without manually constructing complex attack chains.

Our take on the response

• Review current AWS IAM permissions to identify principals with broad access rights.
• Map out potential privilege escalation paths using the techniques documented in pathfinding.cloud.
• Deploy Pathfinding Labs in a sandbox account to test detection capabilities against simulated attacks.
• Use Pathrunner to automate the testing of these paths in non-production environments to validate security controls.

What defenders should look for

Teams usually monitor for unusual identity switching or credential access patterns that indicate lateral movement. Check whether logs show a single principal accessing resources outside its typical scope or assuming roles without a clear operational reason. Look for rapid sequences of API calls that suggest automated exploitation rather than manual administration. The first containment moves often involve revoking suspicious session tokens and isolating the affected identity to prevent further escalation. Verify that multi-factor authentication is enforced for sensitive operations to add friction to automated attacks.

Background: Lateral movement

Lateral movement is the process where an attacker navigates from one system to another within a network after initial access. They use stolen credentials or unpatched vulnerabilities to expand their reach. This tactic allows them to reach sensitive data or critical servers without triggering perimeter alarms, making internal monitoring the primary defense.

Read the full guide: Lateral Movement in Cybersecurity: Definition and Detection

What to do and how to stay safe: Datadog

• Audit AWS IAM policies to remove unnecessary permissions that could enable privilege escalation.
• Enable detailed logging for IAM actions and identity switches to detect anomalous behavior early.
• Test detection rules using Pathfinding Labs to ensure alerts trigger on simulated escalation attempts.
• Once the vendor provides an update, review any new exploit modules in Pathrunner to adjust defenses.

Step-by-step guide: Multi-Factor Authentication Best Practices for Secure Access

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is Pathrunner and who released it?

Pathrunner is a modular, cloud-native offensive security framework released by Datadog Security Labs to automate the exploitation of AWS IAM privilege escalation paths.

How does Pathrunner differ from traditional attack simulation tools?

Pathrunner focuses on identity-based lateral movement in cloud environments, allowing users to import credentials and switch between identities, rather than relying on network sessions between workloads.

When were the related pathfinding.cloud and Pathfinding Labs released?

pathfinding.cloud was released in December 2025, and Pathfinding Labs was released in May 2026, preceding the launch of Pathrunner.