tool

Peirates S0683

Type: tool
Platform: Containers
Created: 8 February 2022
Last modified: 16 April 2025

Peirates is a post-exploitation Kubernetes exploitation framework with a focus on gathering service account tokens for lateral movement and privilege escalation. The tool is written in GoLang and publicly available on GitHub.[1]

Techniques54th pct

TacticsTop 11%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0683

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects when an account is disabled or blocked for sign in but tried to log in	Generic	test	authentication	-	Azure Sign-in Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Yochana Henderson, '@Yochana-H'	2022-06-17	—	4afac85c-224a-4dd7-b1af-8da40e1c60bd
Splunk	The following analytic detects the execution of network scanning utilities such as Advanced IP Scanner or Advanced Port Scanner. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Network Service Discovery Discovery Network Share Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-10-24	2026-05-13	9a4e50c7-5b62-4d52-93b4-f2b61332e9a5
	Detects the use of Advanced IP Scanner. (...)	Generic	test	file_event	windows	Sysmon	Discovery Network Service Discovery	-	medium	@ROxPinTeddy	2020-05-12	2022-11-29	fed85bf9-e075-4280-9159-fbe8a023d6fa
	Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.	Generic	test	-	-	Azure Risk Detection · Azure	Credential Access Steal Application Access Token	-	high	Mark Morowczynski '@markmorow'	2023-08-07	—	6555754e-5e7f-4a67-ad1c-4041c413a007
	Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.	Generic	test	-	-	Azure Risk Detection · Azure	Credential Access Steal Application Access Token	-	high	Gloria Lee, '@gleeiamglo'	2023-08-22	—	53acd925-2003-440d-a1f3-71a5253fe237
	Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchan (...)	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Credential Access Steal Application Access Token	-	high	Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'	2022-07-10	—	c1d147ae-a951-48e5-8b41-dcd0170c7213
	Detects when a configuration change is made to an applications AppID URI.	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Credential Access Unsecured Credentials Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'	2022-06-02	—	1b45b0d1-773f-4f23-aedc-814b759563b1
	Detects when a configuration change is made to an applications URI. (...)	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Credential Access Steal Application Access Token Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'	2022-06-02	—	0055ad1f-be85-4798-83cf-a6da17c993b3
Splunk	The following analytic identifies the creation of a new AWS IAM policy version that allows access to all resources. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Patrick Bareiss, Splunk	2021-02-22	2026-05-13	22cc7a62-3884-48c4-82da-592b8199b72f
	Detects potentially suspicious events involving "GetSigninToken". (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Lateral Movement Remote Services Cloud Services Lateral Movement Use Alternate Authentication Material Application Access Token	-	medium	Chester Le Bron (@123Le_Bron)	2024-02-26	—	f8103686-e3e8-46f3-be72-65f7fcb4aa53
	Detects AWS console logins from countries and IP addresses that are not recognized as legitimate for the organization. (...)	Placeholder	experimental	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Ivan Saakov	2025-10-19	—	313e72de-0c0d-4d65-8c95-87f4d546eceb
Splunk	The following analytic identifies the creation of a new AWS IAM policy version that allows access to all resources. (...)	Generic	stable	account_management	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Bhavin Patel, Splunk	2021-02-22	2026-05-13	2a9b80d3-6340-4345-b5ad-212bf3d0dac4
	Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter Cloud API Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	daniel.bohannon@permiso.io (@danielhbohannon)	2023-05-17	—	db014773-b1d3-46bd-ba26-133337c0ffee
	Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "<YOUR-BUCKET-NAME>".	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter Cloud API Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	daniel.bohannon@permiso.io (@danielhbohannon)	2023-05-17	—	db014773-7375-4f4e-b83b-133337c0ffee
	Detects S3 Browser utility creating IAM User or AccessKey.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter Cloud API Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	daniel.bohannon@permiso.io (@danielhbohannon)	2023-05-17	—	db014773-d9d9-4792-91e5-133337c0ffee
	Detects AWS root account usage	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	vitaliy0x1	2020-01-21	2022-10-09	8ad1600d-e9dc-4251-b0ee-a65268f29add
	Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Impact Account Access Removal Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Ivan Saakov	2024-12-19	—	ccd6a6c8-bb4e-4a91-9d2a-07e632819374
Splunk	The following analytic detects when a user sets a default policy version in AWS. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Bhavin Patel, Splunk	2021-03-02	2026-05-13	2a9b80d3-6340-4345-11ad-212bf3d0dac4
	Identifies the suspicious use of AssumeRole. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Privilege Escalation Abuse Elevation Control Mechanism Lateral Movement Use Alternate Authentication Material Application Access Token	-	low	Austin Songer @austinsonger	2021-07-24	2022-10-09	905d389b-b853-46d0-9d3d-dea0d3a3cd49
	Identifies the suspicious use of GetSessionToken. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Privilege Escalation Abuse Elevation Control Mechanism Lateral Movement Use Alternate Authentication Material Application Access Token	-	low	Austin Songer @austinsonger	2021-07-24	2022-10-09	b45ab1d2-712f-4f01-a751-df3826969807
	Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA). (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Thuya@Hacktilizer, Ivan Saakov	2025-10-18	2025-10-21	77caf516-34e5-4df9-b4db-20744fea0a60
Splunk	The following analytic identifies a successful Console Login authentication event for an AWS IAM user account without Multi-Factor Authentication (MFA) enabled. (...)	Generic	stable	authentication	-	AWS CloudTrail · AWS	Resource Development Compromise Accounts Cloud Accounts Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Bhavin Patel, Splunk	2022-10-04	2026-05-13	a520b1fe-cc9e-4f56-b762-18354594c52f
	Identifies when suspicious SAML activity has occurred in AWS. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Privilege Escalation Abuse Elevation Control Mechanism Lateral Movement Use Alternate Authentication Material Application Access Token Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Austin Songer	2021-09-22	2022-12-18	f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e
Splunk	The following analytic identifies failed authentication attempts against an Azure AD tenant during the Multi-Factor Authentication (MFA) challenge, specifically flagged by error code 500121. (...)	Generic	stable	authentication	-	Microsoft 365	Resource Development Compromise Accounts Cloud Accounts Credential Access Multi-Factor Authentication Request Generation Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk, 0xC0FFEEEE	2022-07-14	2026-05-13	e62c9c2e-bf51-4719-906c-3074618fcc1c
Splunk	The following analytic identifies Azure Device Code Phishing attacks, which can lead to Azure Account Take-Over (ATO). (...)	Generic	stable	authentication	-	Microsoft 365	Initial Access Phishing Spearphishing Link Credential Access Steal Application Access Token	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2023-11-16	2026-05-13	d68d8732-6f7e-4ee5-a6eb-737f2b990b91
Splunk	The following analytic identifies multiple failed multi-factor authentication (MFA) requests for a single user within an Azure AD tenant. (...)	Generic	stable	authentication	-	Microsoft 365	Resource Development Compromise Accounts Cloud Accounts Credential Access Multi-Factor Authentication Request Generation Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2022-08-25	2026-05-13	264ea131-ab1f-41b8-90e0-33ad1a1888ea
Splunk	The following analytic detects when a user in an Azure AD environment grants consent to an OAuth application. (...)	Generic	stable	account_management	-	Microsoft 365	Credential Access Steal Application Access Token	-	medium	Mauricio Velazco, Splunk	2023-11-16	2026-09-24	10ec9031-015b-4617-b453-c0c1ab729007
	Detect when users are authenticating without MFA being required.	Generic	test	authentication	-	Azure Sign-in Logs · Azure	Persistence, Defense Impairment, Credential Access Modify Authentication Process Multi-Factor Authentication Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	low	MikeDuddington, '@dudders1'	2022-07-27	—	28eea407-28d7-4e42-b0be-575d5ba60b2c
Splunk	The following analytic identifies authentication events of service principals in Azure Active Directory. (...)	Generic	stable	authentication	-	Microsoft 365	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Mauricio Velazco, Splunk	2024-02-14	2026-05-13	5a2ec401-60bb-474e-b936-1e66e7aa4060
Splunk	The following analytic identifies a successful authentication event against an Azure AD tenant using PowerShell cmdlets. (...)	Generic	stable	authentication	-	Microsoft 365	Resource Development Compromise Accounts Cloud Accounts Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2022-07-12	2026-05-13	62f10052-d7b3-4e48-b57b-56f8e3ac7ceb
Splunk	The following analytic identifies a successful single-factor authentication event against Azure Active Directory. (...)	Generic	stable	authentication	-	Microsoft 365	Resource Development Compromise Accounts Cloud Accounts Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2022-07-12	2026-05-13	a560e7f6-1711-4353-885b-40be53101fcd
Splunk	The following analytic detects instances where Azure AD has blocked a user's attempt to grant consent to a risky or potentially malicious application. (...)	Generic	stable	account_management	-	Microsoft 365	Credential Access Steal Application Access Token	-	medium	Mauricio Velazco, Splunk	2023-11-16	2026-09-24	06b8ec9a-d3b5-4882-8f16-04b4d10f5eab
Splunk	The following analytic identifies instances where a user has denied consent to an OAuth application seeking permissions within the Azure AD environment. (...)	Generic	stable	authentication	-	Microsoft 365	Credential Access Steal Application Access Token	-	medium	Mauricio Velazco, Splunk	2023-11-16	2026-05-13	bb093c30-d860-4858-a56e-cd0895d5b49c
	Identifies when an admission controller is executed in Azure Kubernetes. (...)	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Credential Access Unsecured Credentials Container API Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Austin Songer @austinsonger	2021-11-25	2022-12-18	a61a3c56-4ce2-4351-a079-88ae4cbd2b58
Splunk	The following analytic detects the creation of a new Automation Runbook Webhook within an Azure tenant. (...)	Generic	stable	scheduled_job	-	Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Mauricio Velazco, Brian Serocki, Splunk	2022-08-23	2026-05-13	e98944a9-92e4-443c-81b8-a322e33ce75a
	Detects when a user has been elevated to manage all Azure Subscriptions. (...)	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	Austin Songer @austinsonger	2021-11-26	2022-08-23	09438caa-07b1-4870-8405-1dbafe3dad95
	Detects user authentication failure events. (...)	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Credential Access Brute Force Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	70ed1d26-0050-4b38-a599-92c53d57d45a
	Monitor and alert for Bitlocker key retrieval.	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Michael Epping, '@mepples21'	2022-06-28	—	a0413867-daf3-43dd-9245-734b3a787942
	Detects when changes are made to PIM roles	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'	2022-08-09	—	db6c06c4-bf3b-421c-aa88-15672b88c743
Splunk	This analytic detects file copy activity on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Collection Data from Cloud Storage Collection Data from Local System	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	4d7e8f3a-9c2b-4e6f-8a1d-5b9c7e2f4a8c
Splunk	This analytic detects Cisco IOS-XE guestshell enable activity followed by activation and destroy lifecycle logs. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Execution Command and Scripting Interpreter Privilege Escalation Escape to Host	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	ff82a536-8fde-4963-a801-815826fcdf75
Splunk	This analytic detects bursts of ping, SSH, and Telnet commands issued from Cisco IOS or NX-OS devices. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Discovery Network Service Discovery Lateral Movement Remote Services SSH Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	efb20922-17bc-4fb0-880c-be50cfc100dd
Splunk	The following analytic detects workloads accessing the cloud instance metadata service at 169.254.169.254. (...)	Anomaly	stable	network_device	-	Cisco	Credential Access Unsecured Credentials Cloud Instance Metadata API	-	medium	Bhavin Patel, Splunk	2026-01-05	2026-05-13	7f2e1a9a-1e8e-4d2e-8b7c-5f2c3d6a9b21
Splunk	This analytic detects potential container escape or reconnaissance attempts by monitoring for the rapid execution of multiple suspicious Linux commands (nsenter, mount, ps aux, and ls) within a short time window. (...)	Anomaly	stable	process_creation	-	Cisco	Privilege Escalation Escape to Host	-	medium	Bhavin Patel, Splunk	2026-01-05	2026-05-13	2b8a7a21-bec6-4e1f-84c4-7b319f45d2ab
Splunk	The following analytic detects a blocked connection event by identifying a "Block" value in the action field. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	17e9b764-3a2b-4d36-9751-32d13ce4718b
Splunk	The following analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	1f57f10e-1dc5-47ea-852c-2e85b2503d79
Splunk	The following analytic identifies the creation of cloud compute instances by users who have not previously created them. (...)	Anomaly	stable	configuration_change	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Rico Valdez, Splunk	2019-10-16	2026-09-22	37a0ec8d-827e-4d6d-8025-cedf31f3a149	-
Splunk	The following analytic identifies cloud instances being modified by users who have not previously modified them. (...)	Anomaly	stable	configuration_change	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Rico Valdez, Splunk	2020-11-16	2026-09-22	7fb15084-b14e-405a-bd61-a6de15a40722	-
	Detects creation of a container with a hostPath mount. (...)	Generic	test	-	-	Kubernetes Audit · Kubernetes	Privilege Escalation Escape to Host	-	low	Leo Tsaousis (@laripping)	2024-03-26	—	402b955c-8fe0-4a8c-b635-622b4ac5f902
	Detects when highly privileged delegated permissions are granted on behalf of all users	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Credential Access Steal Application Access Token	-	high	Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'	2022-07-28	—	a6355fbe-f36f-45d8-8efc-ab42465cbc52

Title

Description

Peirates S0683

Peirates MITRE reference S0683

Standing S0683

Reach

Coverage

Peirates detections S0683