1200KM / tool
Pacu — Attack Tool
Pacu is an open-source AWS exploitation framework. The tool is written in Python and publicly available on GitHub.
Tool identity and evidence
Included because the active pinned ATT&CK object has type tool. This is an upstream classification, not an assurance of benignness or a recommendation to run it.
Aliases: Pacu
Existing author guides
No reviewed association in this snapshot.
Primary documentation
No reviewed association in this snapshot.
Connected ecosystem references
Linked tags
Technique-specific simulations and detections
Detection links describe the associated behavior, not independently verified tool-specific signatures.
- T1049 · System Network Connections Discovery · Detection rules & anomalies
- T1059.009 · Cloud API · Detection rules & anomalies
- T1069.003 · Cloud Groups · Detection rules & anomalies
- T1078.004 · Cloud Accounts · Detection rules & anomalies
- T1087.004 · Cloud Account · Detection rules & anomalies
- T1098.001 · Additional Cloud Credentials · Detection rules & anomalies
- T1119 · Automated Collection · Detection rules & anomalies
- T1518.001 · Security Software Discovery · Detection rules & anomalies
- T1526 · Cloud Service Discovery · Detection rules & anomalies
- T1530 · Data from Cloud Storage · Detection rules & anomalies
- T1546 · Event Triggered Execution · Detection rules & anomalies
- T1552 · Unsecured Credentials · Detection rules & anomalies
- T1555.006 · Cloud Secrets Management Stores · Detection rules & anomalies
- T1578.001 · Create Snapshot · Detection rules & anomalies
- T1580 · Cloud Infrastructure Discovery · Detection rules & anomalies
- T1619 · Cloud Storage Object Discovery · Detection rules & anomalies
- T1648 · Serverless Execution · Detection rules & anomalies
- T1651 · Cloud Administration Command · Detection rules & anomalies
- T1654 · Log Enumeration · Detection rules & anomalies
- T1685.002 · Disable or Modify Cloud Log · Detection rules & anomalies
- T1686.001 · Cloud Firewall · Detection rules & anomalies
Telemetry context
Derived from the explicitly linked TTPs; not proof of sensor coverage for this tool.
- Active Directory Object Creation · DC0087
- Active Directory Object Modification · DC0066
- Application Log Content · DC0038
- Cloud Service Disable · DC0090
- Cloud Service Enumeration · DC0083
- Cloud Service Metadata · DC0070
- Cloud Service Modification · DC0069
- Cloud Storage Access · DC0025
- Cloud Storage Enumeration · DC0017
- Command Execution · DC0064
- File Access · DC0055
- File Creation · DC0039
- File Metadata · DC0059
- File Modification · DC0061
- Firewall Disable · DC0043
- Firewall Rule Modification · DC0051
- Group Enumeration · DC0099
- Group Metadata · DC0105
- Instance Enumeration · DC0075
- Instance Metadata · DC0086
- Logon Session Creation · DC0067
- Logon Session Metadata · DC0088
- Module Load · DC0016
- Network Traffic Content · DC0085
- OS API Execution · DC0021
- Process Creation · DC0032
- Scheduled Job Creation · DC0001
- Script Execution · DC0029
- Snapshot Creation · DC0057
- Snapshot Metadata · DC0062
- User Account Authentication · DC0002
- User Account Metadata · DC0013
- User Account Modification · DC0010
- WMI Creation · DC0008
- Windows Registry Key Modification · DC0063
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.