tool

Pacu S1091

Type: tool
Platform: IaaS
Created: 28 September 2023
Last modified: 19 October 2023

Pacu is an open-source AWS exploitation framework. The tool is written in Python and publicly available on GitHub.[1]

TechniquesTop 18%

TacticsTop 11%

Threat groupsNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S1091

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects when an account is disabled or blocked for sign in but tried to log in	Generic	test	authentication	-	Azure Sign-in Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Yochana Henderson, '@Yochana-H'	2022-06-17	—	4afac85c-224a-4dd7-b1af-8da40e1c60bd
	Detects when a new credential is added to an existing application. (...)	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Persistence, Privilege Escalation Account Manipulation Additional Cloud Credentials	-	high	Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'	2022-05-26	2026-08-20	cbb67ecc-fb70-4467-9350-c910bdf7c628
	Detects when a new owner is added to an application. (...)	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Credential Access Unsecured Credentials	-	medium	Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'	2022-06-02	—	74298991-9fc4-460e-a92e-511aa60baec1
Splunk	The following analytic detects the modification of firewall settings to allow file and printer sharing. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Defense Impairment Disable or Modify System Firewall Cloud Firewall	-	medium	Teoderick Contreras, Splunk	2021-06-23	2026-05-13	ce27646e-d411-11eb-8a00-acde48001122
Splunk	The following analytic detects a suspicious modification to the firewall to allow network discovery on a machine. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Defense Impairment Disable or Modify System Firewall Cloud Firewall	-	medium	Teoderick Contreras, Splunk	2021-06-23	2026-05-13	ccd6a38c-d40b-11eb-85a5-acde48001122
Splunk	The following analytic detects unauthenticated requests to an Amazon EKS Kubernetes cluster, specifically identifying actions by the "system:anonymous" user. (...)	Hunting	experimental	cloud_audit	-	AWS	Discovery Cloud Service Discovery	-	medium	Rod Soto, Splunk	2020-04-29	2026-05-13	294c4686-63dd-4fe6-93a2-ca807626704a	-
Splunk	The following analytic detects unauthenticated requests made against the Kubernetes Pods API, indicating potential unauthorized access attempts. (...)	Hunting	experimental	cloud_audit	-	AWS	Discovery Cloud Service Discovery	-	medium	Rod Soto, Splunk	2020-04-29	2026-05-13	dbfca1dd-b8e5-4ba4-be0e-e565e5d62002	-
	Detects when a configuration change is made to an applications AppID URI.	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Credential Access Unsecured Credentials Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'	2022-06-02	—	1b45b0d1-773f-4f23-aedc-814b759563b1
	Detects when a configuration change is made to an applications URI. (...)	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Credential Access Steal Application Access Token Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'	2022-06-02	—	0055ad1f-be85-4798-83cf-a6da17c993b3
Splunk	The following analytic identifies the creation of a new AWS IAM policy version that allows access to all resources. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Patrick Bareiss, Splunk	2021-02-22	2026-05-13	22cc7a62-3884-48c4-82da-592b8199b72f
Splunk	The following analytic detects AWS `DeleteTrail` events within CloudTrail logs. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools Disable or Modify Cloud Log	-	medium	Patrick Bareiss, Splunk	2022-07-12	2026-05-13	1f0b47e5-0134-43eb-851c-e3258638945e
Splunk	The following analytic detects the deletion of CloudWatch log groups in AWS, identified through `DeleteLogGroup` events in CloudTrail logs. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools Disable or Modify Cloud Log	-	medium	Patrick Bareiss, Splunk	2022-07-19	2026-05-13	0f701b38-a0fb-43fd-a83d-d12265f71f33
Splunk	The following analytic detects the deletion of critical AWS Security Services configurations, such as CloudWatch alarms, GuardDuty detectors, and Web Application Firewall rules. (...)	Hunting	stable	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools Disable or Modify Cloud Log	-	medium	Patrick Bareiss, Bhavin Patel, Gowthamaraj Rajendran, Splunk	2022-07-26	2026-05-13	5029b681-0462-47b7-82e7-f7e3d37f5a2d
Splunk	The following analytic detects `PutBucketLifecycle` events in AWS CloudTrail logs where a user sets a lifecycle rule for an S3 bucket with an expiration period of fewer than three days. (...)	Hunting	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Destruction Lifecycle-Triggered Deletion Defense Impairment Disable or Modify Tools Disable or Modify Cloud Log	-	medium	Patrick Bareiss, Splunk	2022-07-25	2026-05-13	986565a2-7707-48ea-9590-37929cebc938
Splunk	The following analytic detects `StopLogging` events within AWS CloudTrail logs, a critical action that adversaries may use to evade detection. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools Disable or Modify Cloud Log	-	medium	Patrick Bareiss, Splunk	2024-05-22	2026-05-13	0b78a8f9-1d31-4d23-85c8-56ad13d5b4c1
Splunk	The following analytic detects `UpdateTrail` events within AWS CloudTrail logs, aiming to identify attempts by attackers to evade detection by altering logging configurations. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools Disable or Modify Cloud Log	-	medium	Patrick Bareiss, Splunk	2024-05-22	2026-05-13	f3eb471c-16d0-404d-897c-7653f0a78cba
Splunk	The following analytic identifies excessive AccessDenied events within an hour timeframe for IAM users in AWS. (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Discovery Cloud Infrastructure Discovery	-	medium	Patrick Bareiss, Splunk	2022-10-04	2026-05-13	a4f39755-b1e2-40bb-b2dc-4449c45b0bf2
Splunk	The following analytic detects multiple failed attempts to assume an AWS IAM role, indicating a potential brute force attack. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Credential Access Brute Force Discovery Cloud Infrastructure Discovery	-	medium	Patrick Bareiss, Splunk	2022-10-04	2026-05-13	726959fe-316d-445c-a584-fa187d64e295
Splunk	The following analytic detects the successful deletion of a group within AWS IAM, leveraging CloudTrail IAM events. (...)	Hunting	stable	cloud_audit	-	AWS CloudTrail · AWS	Persistence, Privilege Escalation Account Manipulation Discovery Permission Groups Discovery Cloud Groups	-	medium	Patrick Bareiss, Splunk	2024-05-22	2026-05-13	1bbe54f1-93d7-4764-8a01-ddaa12ece7ac
Splunk	The following analytic detects the creation of AWS Network Access Control Lists (ACLs) with all ports open to a specified CIDR. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify System Firewall Cloud Firewall	-	medium	Patrick Bareiss, Splunk	2020-10-27	2026-05-13	a2625034-c2de-44fc-b45c-7bac9c4a7974	-
Splunk	The following analytic detects the deletion of AWS Network Access Control Lists (ACLs). (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify System Firewall Cloud Firewall	-	medium	Patrick Bareiss, Splunk	2022-10-04	2026-05-13	e010ddf5-e9a5-44e5-bdd6-0c919ba8fc8b	-
	Once established within a system or network, an adversary may use automated techniques for collecting internal data.	Generic	test	ps_script	windows	PowerShell	Collection Automated Collection	-	medium	frack113	2021-07-28	2022-12-25	c1dda054-d638-4c16-afc8-53e007f3fbc5
	Once established within a system or network, an adversary may use automated techniques for collecting internal data.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Automated Collection Credential Access Unsecured Credentials Credentials In Files	-	medium	frack113	2021-07-28	2022-11-11	f576a613-2392-4067-9d1a-9345fb58d8d1
Splunk	The following analytic identifies attempts to delete AWS Bedrock GuardRails, which are security controls designed to prevent harmful, biased, or inappropriate AI outputs. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools Disable or Modify Cloud Log	-	medium	Bhavin Patel, Splunk	2025-03-25	2026-05-13	7a5e3d62-f743-11ee-9f6e-acde48001122
Splunk	The following analytic identifies attempts to delete AWS Bedrock model invocation logging configurations. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools Disable or Modify Cloud Log	-	medium	Bhavin Patel, Splunk	2025-03-25	2026-05-13	9c5e3d62-f743-11ee-9f6e-acde48001124
Splunk	The following analytic identifies an high number of AccessDenied attempts to list AWS Bedrock foundation models. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Discovery Cloud Infrastructure Discovery	-	medium	Bhavin Patel, Splunk	2025-03-25	2026-05-13	e84b3c74-f742-11ee-9f6e-acde48001122
	Detects disabling, deleting and updating of a Trail	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools Disable or Modify Cloud Log	-	medium	vitaliy0x1	2020-01-21	2022-10-09	4db60cc0-36fb-42b7-9b58-a5b53019fb74
	Detects AWS Config Service disabling	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools Disable or Modify Cloud Log	-	high	vitaliy0x1	2020-01-21	2022-10-09	07330162-dba1-4746-8121-a9647d49d297
	Detects AWS console logins from countries and IP addresses that are not recognized as legitimate for the organization. (...)	Placeholder	experimental	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Ivan Saakov	2025-10-19	—	313e72de-0c0d-4d65-8c95-87f4d546eceb
Splunk	The following analytic identifies the creation of a new AWS IAM policy version that allows access to all resources. (...)	Generic	stable	account_management	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Bhavin Patel, Splunk	2021-02-22	2026-05-13	2a9b80d3-6340-4345-b5ad-212bf3d0dac4
Splunk	The following analytic detects the deletion of AWS CloudTrail logs by identifying `DeleteTrail` events within CloudTrail logs. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools Disable or Modify Cloud Log	-	medium	Bhavin Patel, Splunk	2022-07-12	2026-05-13	82092925-9ca1-4e06-98b8-85a2d3889552
Splunk	The following analytic detects the deletion of CloudWatch log groups in AWS, identified through `DeleteLogGroup` events in CloudTrail logs. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools Disable or Modify Cloud Log	-	medium	Gowthamaraj Rajendran, Splunk	2022-07-19	2026-05-13	d308b0f1-edb7-4a62-a614-af321160710f
Splunk	The following analytic detects attempts to impair or disable AWS security services by monitoring specific deletion operations across GuardDuty, AWS WAF (classic and v2), CloudWatch, Route 53, and CloudWatch Logs. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools Disable or Modify Cloud Log	-	medium	Bhavin Patel, Gowthamaraj Rajendran, Splunk, PashFW, Github Community	2022-07-26	2026-05-13	b28c4957-96a6-47e0-a965-6c767aac1458
Splunk	The following analytic detects `PutBucketLifecycle` events in AWS CloudTrail logs where a user sets a lifecycle rule for an S3 bucket with an expiration period of fewer than three days. (...)	Hunting	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Destruction Lifecycle-Triggered Deletion Defense Impairment Disable or Modify Tools Disable or Modify Cloud Log	-	medium	Bhavin Patel	2022-07-25	2026-05-13	ce1c0e2b-9303-4903-818b-0d9002fc6ea4
Splunk	The following analytic detects `StopLogging` events in AWS CloudTrail logs. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools Disable or Modify Cloud Log	-	medium	Bhavin Patel, Splunk	2022-07-12	2026-05-13	8a2f3ca2-4eb5-4389-a549-14063882e537
Splunk	The following analytic detects `UpdateTrail` events in AWS CloudTrail logs. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools Disable or Modify Cloud Log	-	medium	Gowthamaraj Rajendran, Splunk	2022-07-19	2026-05-13	7c921d28-ef48-4f1b-85b3-0af8af7697db
Splunk	The following analytic identifies excessive security scanning activities in AWS by detecting a high number of Describe, List, or Get API calls from a single user. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Discovery Cloud Service Discovery	-	medium	Patrick Bareiss, Splunk	2021-04-13	2026-05-13	1fdd164a-def8-4762-83a9-9ffe24e74d5a
Splunk	The following analytic identifies anomalous GetObject API activity in AWS, indicating potential data exfiltration attempts. (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Collection Automated Collection	-	medium	Bhavin Patel, Splunk	2023-04-10	2026-05-13	e4384bbf-5835-4831-8d85-694de6ad2cc6
Splunk	The following analytic identifies the creation of AWS Batch jobs that could potentially abuse the AWS Bucket Replication feature on S3 buckets. (...)	Generic	stable	scheduled_job	-	AWS CloudTrail · AWS	Collection Automated Collection	-	medium	Bhavin Patel, Splunk	2023-04-24	2026-05-13	04455dd3-ced7-480f-b8e6-5469b99e98e2
Splunk	The following analytic detects the creation of an AWS DataSync task, which could indicate potential data exfiltration. (...)	Generic	stable	scheduled_job	-	AWS CloudTrail · AWS	Collection Automated Collection	-	medium	Bhavin Patel, Splunk	2023-04-10	2026-05-13	05c4b09f-ea28-4c7c-a7aa-a246f665c8a2
	Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools Disable or Modify Cloud Log	-	high	suktech24	2025-11-27	—	d2656e78-c069-4571-8220-9e0ab5913f19
Splunk	The following analytic identifies excessive AccessDenied events within an hour timeframe for IAM users in AWS. (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Discovery Cloud Infrastructure Discovery	-	medium	Michael Haag, Splunk	2021-04-06	2026-05-13	3e1f1568-9633-11eb-a69c-acde48001122
Splunk	The following analytic detects multiple failed attempts to assume an AWS IAM role, indicating a potential brute force attack. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Credential Access Brute Force Discovery Cloud Infrastructure Discovery	-	medium	Michael Haag, Splunk	2021-04-06	2026-05-13	f19e09b0-9308-11eb-b7ec-acde48001122
	Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter Cloud API Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	daniel.bohannon@permiso.io (@danielhbohannon)	2023-05-17	—	db014773-b1d3-46bd-ba26-133337c0ffee
	Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "<YOUR-BUCKET-NAME>".	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter Cloud API Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	daniel.bohannon@permiso.io (@danielhbohannon)	2023-05-17	—	db014773-7375-4f4e-b83b-133337c0ffee
	Detects S3 Browser utility creating IAM User or AccessKey.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter Cloud API Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	daniel.bohannon@permiso.io (@danielhbohannon)	2023-05-17	—	db014773-d9d9-4792-91e5-133337c0ffee
Splunk	The following analytic identifies the successful deletion of an IAM group in AWS. (...)	Hunting	stable	account_management	-	AWS CloudTrail · AWS	Persistence, Privilege Escalation Account Manipulation Discovery Permission Groups Discovery Cloud Groups	-	medium	Michael Haag, Splunk	2021-04-06	2026-05-13	e776d06c-9267-11eb-819b-acde48001122
Splunk	The following analytic detects the creation of AWS Network Access Control Lists (ACLs) with all ports open to a specified CIDR. (...)	Generic	stable	network_connection	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify System Firewall Cloud Firewall	-	medium	Bhavin Patel, Patrick Bareiss, Splunk	2020-04-29	2026-05-13	ada0f478-84a8-4641-a3f1-d82362d6bd75	-
Splunk	The following analytic detects the deletion of AWS Network Access Control Lists (ACLs). (...)	Anomaly	stable	configuration_change	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify System Firewall Cloud Firewall	-	medium	Bhavin Patel, Patrick Bareiss, Splunk	2020-04-29	2026-05-13	ada0f478-84a8-4641-a3f1-d82362d6fd75	-
	Detects AWS root account usage	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	vitaliy0x1	2020-01-21	2022-10-09	8ad1600d-e9dc-4251-b0ee-a65268f29add

Title

Description

Pacu S1091

Pacu MITRE reference S1091

Standing S1091

Reach

Coverage

Pacu detections S1091