Stratus Red Team cloud

stratus detonate aws.credential-access.<t>

Executes a cloud attack technique with Stratus Red Team, validating detection of AWS/Azure/GCP compromise with the real attack.

Run it in the purple team lab when you want cloud validation: stratus detonate launches the cloud attack technique (use of stolen credentials, creation of mining resources, S3 exfiltration) against the test account and the team verifies what was detected — CloudTrail, GuardDuty, the SIEM. It's the Atomic Red Team for the cloud: the real technique executed and coverage measured. In cloud purple teaming, Stratus is the standard: warmup prepares the technique, detonate executes it, and revert cleans it up — cloud coverage validation with real attacks.

Don't run it in production: the techniques are real (they create resources, generate findings) — the test account (or the dedicated purple team one) is the place. The exercise noise is planned. And watch out: Stratus covers the documented techniques of the project — environment-specific ones are validated with your own simulations. Validation needs connected telemetry (CloudTrail to SIEM): without logs, the technique runs but verification is manual. Cleanup (stratus revert) is part of the flow: resources created by the simulation are removed at the end.