Stratus Red Team

stratus warmup <technique>; stratus detonate

Simulates cloud attack techniques with Stratus Red Team, validating detections against real AWS/Azure/GCP attacks.

Run it when you want to validate that cloud detections work: Stratus Red Team (from DataDog) launches real attack techniques against the account — use of stolen credentials, creation of resources for mining, exfiltration via S3 — and the team verifies what was detected (CloudTrail, GuardDuty, the SIEM). It's the Atomic Red Team for the cloud: each technique is documented with the expected detection. In cloud purple teaming, Stratus is the standard: warmup prepares the technique (creates the necessary resources) and detonate executes it — validating detection coverage with real attacks, in a test environment.

Don't run it in production: the techniques are real — they create resources, generate activity, and detections (GuardDuty, Security Hub) flag them as incidents; the test environment (or the dedicated purple team account) is the place. The noise from the exercise is planned (teams notified, rules in test mode). And watch the scope: Stratus covers the documented techniques of the project — environment-specific ones (a custom app, a business pattern) require your own simulations. Validation needs connected telemetry: without logs in the SIEM, the technique runs but detection verification is manual. Cleanup (stratus revert) is part of the flow: resources created by the simulation are removed when done.