Stratus Red Team

What Stratus Red Team is

Stratus Red Team is a self-contained Go binary for running focused offensive techniques against live cloud environments to validate detections. Its techniques map to MITRE ATT&CK and cover AWS, Azure, GCP, Kubernetes, Amazon EKS, and Entra ID. For a technique, it can prepare prerequisites, run the activity, reverse side effects, and clean up what it created. Terraform handles prerequisite infrastructure behind the scenes, and Stratus downloads its own Terraform binary. Installation options include Go, Homebrew, pre-built Linux, Windows, and macOS binaries, and Docker. It can also be used as a Go library for automation and custom techniques, although the standalone binary does not dynamically load added techniques. Documentation recommends an administrator role in a sandbox cloud account or Kubernetes cluster and warns against environments that handle production workloads or infrastructure. Stratus does not create or destroy Kubernetes clusters; it assumes an existing test cluster and authentication to it. AWS customer-provided detonation infrastructure is unsupported, and Azure resource location is fixed to West US, California. State is stored under $HOME/.stratus-red-team, with optional correlation IDs to isolate concurrent executions.