- Home
- Breach and Attack Simulation Software
- Stratus Red Team
Stratus Red Team
New York City, New York, USA
What it is
Stratus Red Team is a free, open-source Go binary for running granular offensive techniques against live cloud environments to validate detections. Techniques map to MITRE ATT&CK and cover AWS, Azure, GCP, Kubernetes, Amazon EKS, and Entra ID. For each technique, Stratus can prepare prerequisites, detonate the activity, reverse side effects, and clean up what it created. Terraform manages prerequisite infrastructure behind the scenes, and the tool downloads its own Terraform binary. Installation options include Go, Homebrew, pre-built Linux, Windows, and macOS binaries, and Docker. Stratus can also run as a Go library for automation and custom techniques. The standalone binary embeds its supported techniques and does not dynamically load additions. Documentation recommends administrator access in a sandbox cloud account or Kubernetes cluster and warns against production environments. Kubernetes clusters must already exist. AWS customer-provided detonation infrastructure is unsupported, and Azure resources use a fixed West US, California location. State is stored under $HOME/.stratus-red-team.
For and against
For
- Free and open source
- Maps techniques to MITRE ATT&CK
- Supports six cloud or cluster surfaces
- Cleans up technique prerequisites
- Offers Go library automation
Against
- Requires a sandbox, not production
- Kubernetes clusters must already exist
- Azure location is fixed to West US
- Binary cannot dynamically load techniques
The verdict
Stratus Red Team provides repeatable cloud attack simulations with setup, detonation, reversal, and cleanup steps. Its environment warnings and platform limits should be considered before use.
Who it suits
Stratus Red Team suits security practitioners who need ATT&CK-mapped cloud attack simulations in sandbox AWS, Azure, GCP, Kubernetes, EKS, or Entra ID environments.
On the record
- Attack lifecycle
- For a technique, Stratus can prepare prerequisites, detonate the technique, revert side effects, and clean up prerequisites.stratus-red-team.cloud · read 8 Oct 2026
- ATT&CK mapping
- Attack techniques are mapped to MITRE ATT&CK, and the documentation provides coverage matrices by cloud platform.stratus-red-team.cloud · read 8 Oct 2026
- Automation
- Stratus Red Team can be used programmatically as a Go library for automation and custom attack techniques.stratus-red-team.cloud · read 8 Oct 2026
- AWS limitation
- Using customer-provided detonation infrastructure for AWS techniques is currently unsupported; the tool creates the required infrastructure itself.stratus-red-team.cloud · read 8 Oct 2026
- Azure limitation
- For Azure, the resource location is fixed to West US (California) and cannot be configured.stratus-red-team.cloud · read 8 Oct 2026
- Azure region limit
- For Azure, the location where resources are created is fixed to West US (California) and cannot be configured.stratus-red-team.cloud · read 8 Oct 2026
- Cloud and cluster coverage
- Supported platforms are AWS, Azure, GCP, Kubernetes, Amazon EKS, and Entra ID.stratus-red-team.cloud · read 8 Oct 2026
- Cloud coverage
- It supports AWS, Azure, GCP, Kubernetes, Amazon EKS, and Entra ID.stratus-red-team.cloud · read 8 Oct 2026
- Cluster prerequisite
- Stratus Red Team does not create Kubernetes or EKS clusters and assumes the user is already authenticated to a test cluster.stratus-red-team.cloud · read 8 Oct 2026
- Custom techniques
- The self-contained binary does not dynamically load added techniques, though users can contribute techniques or define them when using the Go library.stratus-red-team.cloud · read 8 Oct 2026
- Detection mapping
- Its attack techniques are mapped to MITRE ATT&CK.stratus-red-team.cloud · read 8 Oct 2026
- Format
- It is a self-contained Go binary that embeds the attack techniques it supports emulating.stratus-red-team.cloud · read 8 Oct 2026
- Infrastructure setup
- It uses Terraform behind the scenes to create and remove attack-technique prerequisites, and downloads its own Terraform binary.stratus-red-team.cloud · read 8 Oct 2026
- Installation
- Installation options include Go, Homebrew, pre-built binaries for Linux, Windows, and macOS, and Docker.stratus-red-team.cloud · read 8 Oct 2026
- Install options
- The getting-started guide lists Go installation, Homebrew, pre-built Linux, Windows and macOS binaries, and Docker.stratus-red-team.cloud · read 8 Oct 2026
- Kubernetes limitation
- Stratus does not create or destroy Kubernetes clusters; it uses an existing cluster and creates required prerequisite resources.stratus-red-team.cloud · read 8 Oct 2026
- Maker
- The documentation copyright is attributed to Datadog, Inc.stratus-red-team.cloud · read 8 Oct 2026
- Permissions
- The FAQ recommends using Stratus Red Team with an administrator role in a sandbox cloud account or Kubernetes cluster.stratus-red-team.cloud · read 8 Oct 2026
