DataDog/stratus-red-team

Health v2 · maintenance only

Adoption not part of the score

2421 stars · 328 forks observed · 2026-10-11

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Stratus Red Team is a self-contained Go CLI that emulates granular, actionable cloud attack techniques mapped to MITRE ATT&CK, against AWS, Azure, GCP, and Kubernetes. It uses Terraform under the hood to spin up prerequisites, detonate techniques, and clean up, helping teams validate threat detections.

Use cases

• validate cloud detection rules by detonating real attack techniques
• emulate MITRE ATT&CK techniques against a sandbox AWS account
• test whether CloudTrail stop or EBS snapshot exfiltration triggers alerts
• run purple team exercises in cloud environments
• simulate cloud-native attacks on Kubernetes clusters
• practice detection engineering with reproducible attack TTPs

When to choose

• you need granular, self-contained attack emulation for AWS, Azure, GCP, or Kubernetes
• you want to validate detection rules against real offensive techniques mapped to MITRE ATT&CK
• you prefer a single Go binary with automatic infrastructure setup and cleanup via Terraform

When to avoid

• you need to detonate techniques against your own pre-existing infrastructure rather than sandbox accounts
• you need a plugin system for custom techniques in a scripting language (custom techniques require Go library usage)
• you lack administrator access to a disposable cloud account or cluster

Facets

cli-tool · maturity active

security penetration-testing cli developer-tools security cloud-computing penetration-testing windows go cli adversary-emulation mitre-attack purple-team detection-engineering cloud-security red-team aws azure gcp kubernetes devops linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="DataDog/stratus-red-team")