pathfinding.cloud is an open-source knowledge base that documents over 60 AWS IAM privilege escalation paths with prerequisites, exploitation steps, remediation, and tooling coverage. It standardizes each path with unique IDs and machine-readable YAML so security teams and tool authors can identify detection gaps and contribute fixes. #pathfinding.cloud #AWS
Keypoints
- pathfinding.cloud publishes a standardized, open-source library documenting privilege escalation (PrivEsc) paths in AWS, including prerequisites, attack visualizations, remediation, and detection mappings.
- The library contains 65 documented paths and highlights that 27 (42%) of those paths are not detected by evaluated open-source tools, leaving significant detection gaps.
- The project uses a machine-readable YAML schema and exports all entries to a single paths.json to make the data consumable by security tools and scripts.
- Paths are categorized into five types (Self-Escalation, Principal Access, New PassRole, Existing PassRole, Credential Access) and include distinctions between required and additional permissions.
- Each path gets a unique ID (e.g., ec2-001, lambda-001) and includes fields for discovery attribution, detectionTools, and learningEnvironments to help practitioners validate coverage and practice exploitation in labs.
- The site and repository (github.com/DataDog/pathfinding.cloud) invite contributions so researchers and tool authors can add new paths or fix metadata, making privilege escalation coverage more comprehensive and visible.
MITRE Techniques
- [T0000 ] None – The article does not reference any MITRE ATT&CK technique names or IDs. ‘No MITRE techniques are referenced in the article.’
Indicators of Compromise
- [Domain ] documentation and contribution endpoints – pathfinding.cloud, github.com/DataDog/pathfinding.cloud
- [URL ] example references and data endpoints – https://pathfinding.cloud/paths.json, https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
- [File name ] machine-readable artifacts and exports – paths.json, YAML path files (e.g., ec2-001 YAML)
- [Resource Identifier ] path identifiers used within the library – ec2-001, lambda-001 (and other path IDs like apprunner-001)
Read more: https://securitylabs.datadoghq.com/articles/introducing-pathfinding.cloud/