AWS Detection Engineering with Grimoire

Grimoire is an open-source tool we can use to generate datasets of cloud audit logs for common attacks. For example, it can be used with Stratus Red Team to detonate an attack, injecting a unique user agent containing a UUID, so that Grimoire can then poll CloudTrail logs to retrieve the ones that were caused by the detonation. It will stream those results into your terminal or into a file, and you can use that information for you detection engineering efforts.