DOCSEARCHbyAlgolia
Submit Docs

Stratus Red Team Documentation

repository·main·Indexed 25 days ago

https://github.com/datadog/stratus-red-team

An adversary emulation tool for the cloud that provides granular emulation of offensive attack techniques across AWS, Azure, GCP, Entra ID, and Kubernetes. It can be used via a CLI or as a Go library to programmatically detonate attack techniques, integrate custom logging, inject cloud credentials, and manage remote state via S3 for multi-cloud attacks.

Tokens
105.6K
Snippets
230
Records
381
Agent score
77%

What's inside Stratus Red Team

  1. Overview of Stratus Red Team

    main

    Stratus Red Team is a self-contained binary designed to execute granular, cloud-focused offensive attack techniques against live cloud environments. It is modeled after the concept of "Atomic Red Team" but specifically tailored for cloud infrastructure. It allows security teams to validate threat detection rules by detonating specific techniques that map to the MITRE ATT&CK framework.

    Key features include:

    • Execution of cloud-specific attack techniques.
    • Mapping to MITRE ATT&CK frameworks.
    • Self-contained binary for easy deployment.
    • Ability to detonate techniques against live environments to test detection capabilities.

  2. Explore Kubernetes attack techniques in Stratus Red Team

    main
    Stratus Red Team provides a collection of attack techniques specifically for Kubernetes environments. These techniques are categorized by MITRE ATT&CK tactics, including Persistence, Privilege Escalation, and Credential Access. You can use these techniques to simulate real-world adversary behavior within your Kubernetes clusters to test detection and response capabilities.

  3. Entra ID Attack Techniques Overview

    main

    Stratus Red Team provides several attack techniques targeting Microsoft Entra ID (formerly Azure AD), categorized by MITRE ATT&CK tactics. These techniques are designed to simulate adversary behavior for testing detection and response capabilities.

    Persistence Techniques

    • Backdoor Entra ID application with Federated Identity Credential (FIC): Simulates backdooring an application using FIC.
    • Backdoor Entra ID application through service principal: Simulates backdooring an application via a service principal.
    • Backdoor Entra ID application: General application backdooring.
    • Create Guest User: Simulates the creation of a guest user for persistence.
    • Create Hidden Scoped Role Assignment Through HiddenMembership AU: Simulates creating hidden role assignments.
    • Create Application: Simulates the creation of a new application.
    • Create Sticky Backdoor User Through Restricted Management AU: Simulates creating a backdoor user via restricted management.

    Privilege Escalation Techniques

    • Backdoor Entra ID application with Federated Identity Credential (FIC)
    • Backdoor Entra ID application through service principal
    • Backdoor Entra ID application
    • Create Application

  4. Explore AWS attack techniques by MITRE ATT&CK Tactic

    main

    Stratus Red Team provides a collection of AWS attack techniques categorized by the MITRE ATT&CK framework. You can use these techniques to simulate adversary behavior within an AWS environment to test your detection and response capabilities.

    Techniques are grouped into the following tactics:

    • Initial Access: Gaining entry to the environment (e.g., Console Login without MFA).
    • Execution: Running malicious code or commands (e.g., EC2 User Data, SSM SendCommand).
    • Persistence: Maintaining long-term access (e.g., IAM Backdoors, Lambda modifications).
    • Privilege Escalation: Increasing access levels (e.g., IAM user password changes).
    • Defense Evasion: Avoiding detection (e.g., Deleting CloudTrail logs, removing VPC Flow Logs).
    • Credential Access: Stealing secrets or credentials (e.g., Stealing EC2 instance credentials, retrieving Secrets Manager secrets).
    • Discovery: Exploring the environment (e.g., Enumerating EC2 or SES).
    • Lateral Movement: Moving between resources (e.g., EC2 Instance Connect).
    • Exfiltration: Moving data out of the environment (e.g., Sharing AMIs/Snapshots, opening Security Group ports).
    • Impact: Disrupting services or data (e.g., S3 Ransomware, invoking Bedrock models).

  5. Explore Stratus Red Team attack techniques by cloud provider

    main

    Stratus Red Team provides implemented attack techniques categorized by the target environment. You can find specific techniques for the following platforms:

    • AWS: Techniques targeting Amazon Web Services.
    • Kubernetes: Techniques targeting Kubernetes clusters.
    • Azure: Techniques targeting Microsoft Azure.

  6. Compare Stratus Red Team with other cloud security testing tools

    main

    Stratus Red Team is designed for simulating cloud adversary behavior to validate threat detection with minimal overhead. It differs from other tools in several key ways:

    Key Differentiators

    • Infrastructure Management: Unlike Atomic Red Team, Leonidas, or Pacu, which often require users to manually set up prerequisite infrastructure or IAM users, Stratus Red Team uses Terraform (IaC) to automatically provision the necessary cloud resources, perform the attack, and then clean up (delete) the resources.
    • Ease of Use: Stratus Red Team is distributed as a single binary and requires no prior infrastructure setup in your cloud account. This contrasts with Leonidas, which is a full web application requiring deployment via Terraform and AWS CodePipeline.
    • Granularity: Stratus Red Team focuses on granular attack techniques that reference real-world incidents. This is a different approach than AWS CloudSaga, which focuses on broader attack lifecycle scenarios.
    • Multi-Cloud Support: While tools like Pacu, Amazon GuardDuty Tester, AWS CloudSaga, and CloudGoat are AWS-specific, Stratus Red Team supports AWS, Azure, GCP, AWS EKS, and Kubernetes.
    • Interface: Stratus Red Team uses a CLI (Command Line Interface), whereas tools like Halberd and Leonidas provide a GUI (Graphical User Interface).

    Comparison Summary Table

    ToolPrimary FocusCloud PlatformsImplementation Detail
    Stratus Red TeamAdversary behavior emulationAWS, Azure, GCP, EKS, K8sSingle binary, uses Terraform for IaC
    Atomic Red TeamEndpoint & Cloud TTPsCloud (via Stratus integration)YAML-based, requires manual prerequisites
    HalberdMulti-cloud security testingAWS, Azure, Entra ID, GCP, M365Python-based, GUI-driven
    LeonidasCloud attacker action frameworkAWSWeb app (Terraform/CodePipeline), YAML-based
    PacuAWS exploitation/penetration testingAWSOffensive framework for existing infrastructure
    CloudGoatVulnerable-by-design AWS scenariosAWSCTF-style infrastructure deployment
    DeRFSubset of Stratus techniquesGCPUses Google Cloud Workflows
    Cloud KatanaAzure attack simulationAzureJSON schema-based, uses Azure Functions

  7. Explore Azure attack techniques by MITRE ATT&CK Tactic

    main
    Stratus Red Team provides a variety of attack techniques specifically for Azure environments. These techniques are categorized by their corresponding MITRE ATT&CK Tactic, allowing you to simulate specific adversary behaviors such as Execution, Persistence, Privilege Escalation, Credential Access, Exfiltration, and Impact.

  8. EKS Attack Techniques by MITRE ATT&CK Tactic

    main

    Stratus Red Team provides several attack techniques targeting Amazon Elastic Kubernetes Service (EKS), categorized by their MITRE ATT&CK tactics. These techniques can be used to simulate adversary behavior within an EKS environment.

    Persistence

    • Backdoor aws-auth EKS ConfigMap: Simulates an attacker modifying the aws-auth ConfigMap to maintain access.

    Privilege Escalation

    • Backdoor aws-auth EKS ConfigMap: Simulates an attacker modifying the aws-auth ConfigMap to escalate privileges.

    Lateral Movement

    • Create Admin EKS Access Entry: Simulates an attacker creating an EKS Access Entry with administrative permissions to move laterally within the cluster.

  10. Explore GCP attack techniques by MITRE ATT&CK Tactic

    main

    Stratus Red Team provides a collection of attack techniques specifically for Google Cloud Platform (GCP), organized by the MITRE ATT&CK framework. You can find techniques categorized under the following tactics:

    • Initial Access: Techniques for gaining entry, such as stealing GCE Default Service Account tokens.
    • Execution: Running malicious code, e.g., injecting startup scripts into Vertex AI Workbench.
    • Persistence: Maintaining access, including backdooring service accounts, creating admin accounts, or adding SSH keys to metadata.
    • Privilege Escalation: Increasing access levels, such as impersonating service accounts.
    • Defense Evasion: Avoiding detection by disabling audit logs, deleting log sinks, or removing VPC flow logs.
    • Credential Access: Stealing credentials, such as retrieving Secret Manager secrets.
    • Discovery: Exploring the environment, like enumerating service account permissions or reading instance metadata.
    • Lateral Movement: Moving through the environment, e.g., using SSH keys in instance metadata.
    • Exfiltration: Moving data out, such as sharing compute disks, images, or snapshots.
    • Impact: Causing disruption, including creating unauthorized GPU VMs or performing GCS ransomware attacks.

  11. View MITRE ATT&CK coverage matrices by platform

    main
    Stratus Red Team provides coverage matrices mapping MITRE ATT&CK tactics and techniques to specific attack techniques available for various cloud platforms. You can use these matrices to identify which security controls or detection capabilities you should test for specific adversary behaviors in AWS, Azure, GCP, Kubernetes, Entra ID, and EKS.

  12. How attack techniques work in Stratus Red Team

    main

    Stratus Red Team operates on the concept of attack techniques, which are granular TTPs (Tactics, Techniques, and Procedures) that may require specific infrastructure or configuration. The lifecycle of a technique involves several states:

    • Warm-up: A preparation phase where prerequisites (infrastructure/configuration) are met without executing the actual attack. Stratus Red Team uses Terraform internally to manage these prerequisites.
    • Detonating: Executing the attack technique against a live environment.
    • Reverting: Cancelling the detonation to undo side effects (e.g., unsharing a snapshot).
    • Cleaning up: Removing all prerequisites and ensuring no resources remain in the environment.

    An attack technique is considered idempotent if it can be detonated multiple times without needing to be reverted first.