Pacu
MITRE ATT&CK: S1091 View on attack.mitre.org
Aliases: Pacu
- Malware type
- exploit-kit
- Family
- Malware family
- Operating systems
- iaas
- Profile updated
- 2026-07-07 15:32:46
Targeted industries: technology-and-telecommunications financial-services government-and-public-sector
Context
Pacu is an open-source AWS exploitation framework. The tool is written in Python and publicly available on GitHub.
Detection coverage
- 100 Sigma rules
Malware & tools used
- Serverless Execution (attack-pattern)
- Disable or Modify Cloud Log (attack-pattern)
- Cloud Storage Object Discovery (attack-pattern)
- System Network Connections Discovery (attack-pattern)
- Log Enumeration (attack-pattern)
- Cloud Service Discovery (attack-pattern)
- Unsecured Credentials (attack-pattern)
- Event Triggered Execution (attack-pattern)
- Cloud Firewall (attack-pattern)
- Cloud Groups (attack-pattern)
- Additional Cloud Credentials (attack-pattern)
- Cloud Secrets Management Stores (attack-pattern)
- Cloud Infrastructure Discovery (attack-pattern)
- Cloud API (attack-pattern)
- Data from Cloud Storage (attack-pattern)
- Cloud Accounts (attack-pattern)
- Automated Collection (attack-pattern)
- Security Software Discovery (attack-pattern)
- Create Snapshot (attack-pattern)
- Cloud Account (attack-pattern)
- Cloud Administration Command (attack-pattern)
Reports & references
- MITRE ATT&CK — S1091 (report)
- github.com — Pacu (report)