Stratus Red Team is Datadog's open-source, self-contained Go binary that emulates granular offensive cloud attack techniques against AWS, Azure, GCP, Entra ID and Kubernetes for purple-team and detection-engineering work.
| Tool | DataDog/stratus-red-team — granular, self-contained adversary emulation for the cloud, "Atomic Red Team for the cloud" |
| Category | Cloud adversary emulation / attack simulation framework (Go, ~2.4k stars, Apache-2.0) |
| Primary Use | Detonating individual mapped-to-ATT&CK attack techniques in cloud accounts to validate CloudTrail, GuardDuty, SIEM and EDR detections during purple-team exercises |
| Safe Use | Intended exclusively for authorized assessments, dedicated security lab cloud accounts, and detection validation in environments you own or have written permission to test |
| Telemetry Note | Each detonation deliberately generates native cloud audit logs (e.g., CloudTrail events, Azure/GCP activity logs) that defenders can use to build and verify detections |
Stratus Red Team, hosted at DataDog/stratus-red-team, describes itself as "Atomic Red Team for the cloud," and that analogy is precise: where Red Canary's project atomizes on-premises ATT&CK techniques, Stratus does the same for cloud-native attack behavior across AWS, Azure, GCP, Entra ID, and Kubernetes. Each attack technique is a self-contained, granular unit that can be detonated individually against an authenticated cloud provider, producing exactly the audit-log telemetry a real attacker would leave behind. The project is written in Go, ships as a single static binary, is licensed under Apache-2.0, and sits at roughly 2,400 stars — solid institutional backing from Datadog rather than a hobbyist one-off.
The architecture, as revealed by the README, is built around a clean lifecycle. The repository's own agent skills describe running "warmup, detonation, and cleanup phases" for a given technique ID, which tells you the internal model: a technique first provisions whatever prerequisites it needs (warmup), executes the emulated attack action (detonation), and then reverts the environment to its prior state (cleanup). This matters operationally because it means you can run the same technique repeatedly against a detection pipeline without accumulating orphaned cloud resources or unbounded bills, a failure mode that plagues hand-rolled cloud attack labs.
Installation is deliberately frictionless, which is one of the tool's quiet strengths. The README lists a go install -v github.com/datadog/stratus-red-team/v2/cmd/stratus@latest path for Go 1.23+ users, plus a brew tap, pre-built binaries for Linux, Windows, and macOS, a ghcr.io/datadog/stratus-red-team Docker image, and even an asdf plugin for pinning specific versions. The Docker variant is notable for how it handles credentials: the documented alias passes AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, and AWS_DEFAULT_REGION through as environment variables and mounts $HOME/.stratus-red-team/ for state persistence — a clean separation of tool, credentials, and state.
Technique coverage is catalogued at stratus-red-team.cloud, the project's documentation site, where each technique is mapped to MITRE ATT&CK. The topics list on the repository — adversary-emulation, purple-team, detection-engineering, threat-detection, alongside provider-specific tags like aws-security, azure-security, gcp-security, and kubernetes-security — frames the tool's identity accurately: this is a detection-engineering instrument first, an offensive simulator second. The point of detonating a technique is rarely the technique itself; it is the question "did my CloudTrail-based rule, my SIEM correlation, or my GuardDuty finding actually fire on realistic behavior?"
Beyond the CLI, Stratus is designed to be embedded. The README points to an examples/ directory and a "Programmatic Usage" guide, meaning you can import it as a Go library and orchestrate detonations from your own tooling. Datadog demonstrates this pattern concretely with Threatest, a sibling project listed in the community section that chains Stratus detonations with alert assertions — effectively closing the loop between "attack happened" and "alert was raised" in a CI-friendly way. That library-first design is what separates Stratus from interactive AWS exploitation frameworks like pacu, which it explicitly lists among similar projects.
The comparison section is unusually candid and useful for tool selection. The README names Atomic Red Team, Leonidas from F-Secure, pacu and CloudGoat from Rhino Security Labs, and awslabs' Amazon GuardDuty Tester, with a dedicated comparison page on the docs site. The positioning is legible: pacu and CloudGoat are offensive-oriented exploitation and vulnerable-infrastructure projects, Leonidas frames emulation as AWS Step Functions scenarios, while Stratus optimizes for granular, on-demand technique detonation with built-in cleanup and multi-provider breadth.
The community footprint documented in the README is extensive and worth mining as a learning path. There are integration-oriented blog posts covering Stratus with Datadog Cloud SIEM, Wazuh (both AWS and GCP variants), and Azure Sentinel; a DEF CON Cloud Village 2022 talk on purple teaming in the cloud; and a Picus Security data-driven comparison of open-source adversary emulation tools. The presence of an Aalto University master's thesis on purple-team attack automation in cloud-native environments signals that the tool has become a reference artifact in academic cloud-security research as well.
For maintainers and contributors, the repository shows healthy engineering hygiene: GitHub Actions workflows for test.yml and static-analysis.yml, an OpenSSF Scorecard badge, and a CII Best Practices badge — all visible in the README's badge row. Local development is standard make-driven: make builds to ./bin/stratus, go run cmd/stratus/*.go list runs from source, make test runs the suite, and documentation is built with mkdocs-material and mkdocs-awesome-pages-plugin. Core maintainers are Christophe Tafani-Derepper (@christophetd) and Simon Maréchal (@Minosity-VR).
An interesting modern detail is the inclusion of agent skills in the repository under .claude/skills/: create-attack-technique scaffolds new techniques across all five supported platforms following project style guidelines, test-attack-technique automates the warmup/detonation/cleanup cycle and produces an HTML report, and map-threat-intel-coverage ingests a threat-intelligence report, extracts cloud TTPs, classifies them against existing Stratus coverage, and drafts GitHub issues for gaps. That last one is a genuinely clever workflow: it turns coverage analysis into an automated gap-finding exercise, which is exactly how a mature detection program should think about emulation libraries.
From a defensive observability standpoint, Stratus is transparent by design. Detonations generate authentic provider audit events — think CloudTrail records in AWS or platform activity logs elsewhere — and the community's CloudTrail cheat sheets and Sigma-based response writeups referenced in the README are built on exactly that telemetry. Defenders running Stratus in a lab account should treat the resulting event streams as labeled ground truth for detection tuning, and should isolate the account with scoped, low-privilege credentials since the tool acts with real permissions against real cloud APIs.
The appropriate authorization boundary deserves emphasis. Stratus detonates real API actions against real cloud environments — creating resources, changing configurations, or executing actions an attacker would. It belongs in dedicated lab accounts, sandbox tenants, or explicitly authorized engagements, never against production infrastructure without written approval. Used that way, it is one of the cleanest instruments available for the unglamorous but essential work of proving that your cloud detections actually detect.
DataDog/stratus-red-team.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.