Leonidas (cloud sim)

leonidas execute --technique <t>

Executes cloud attack techniques with Leonidas (from ThreatResponse's detection team), validating AWS environment detections.

Run it when you want detection validation with the academic cloud framework: Leonidas (by Chris Farris / ThreatResponse) executes documented attack techniques against AWS — each technique with its definition (steps, resources, expected CloudTrail detections) — and the team verifies what was detected. It's the project that inspired cloud detection validation: techniques are executed and coverage is measured. In cloud purple teaming, Leonidas is the alternative to Stratus with a documentary approach: the technique, its definition, and expected detection queries.

Do not run it in production: the techniques create resources and generate activity — the test environment is the place. The project is barely maintained (development slowed compared to Stratus): for current validation, Stratus is the reference and Leonidas the academic complement. And watch out for scope: the techniques cover AWS (documented services) — environment-specific ones require your own simulations. Validation needs connected telemetry (CloudTrail to SIEM). Cleaning up created resources is part of the flow.