Simulate Cloud Attacks

Validate security controls and detection coverage with repeatable adversary emulation.

Red Canary’s Atomic Red Team™

A library of tests mapped to the MITRE ATT&CK® framework for testing cloud environments, containers, Microsoft 365, Linux, macOS, Windows, and more.

Getting started

Install Invoke-AtomicRedTeam
Import a module
Check prerequisites
List atomic tests

Review the details for a technique

› Invoke-AtomicTest T1003 -ShowDetailsBrief

Execute specific tests by atomic test number

› Invoke-AtomicTest T1218.010 -TestNumbers 1,2

Execute every test for a technique with a process timeout

› Invoke-AtomicTest T1218.010 -TimeoutSeconds 15

Emulate adversaries in sequence

Create a CSV list of atomic tests for Atomic Runner to execute.

List each test in the CSV file

› Invoke-AtomicRunner -listOfAtomics .\IcedID.csv -ShowDetailsBrief

Run the prerequisites command for each test

› Invoke-AtomicRunner -listOfAtomics .\IcedID.csv -GetPrereqs

Run each test

› Invoke-AtomicRunner -listOfAtomics .\IcedID.csv

Clean up after the tests

› Invoke-AtomicRunner -listOfAtomics .\IcedID.csv -Cleanup

Datadog’s Stratus Red Team

“Atomic Red Team™” for the cloud, providing granular, self-contained offensive techniques for AWS, Azure, GCP, Microsoft Entra ID, and Kubernetes.

Explore the CLI

› stratus -h

cleanupClean up leftover infrastructure or configuration

completionGenerate an autocompletion script for your shell

detonateDetonate one or more attack techniques

helpShow help for any command

listList attack techniques

revertRevert an attack technique

showDisplay details about an attack technique

statusDisplay the status of techniques

versionDisplay the current CLI version

warmupCreate prerequisites without detonating the technique

Find an attack technique

› stratus list --platform aws --mitre-attack-tactic persistence

Browse the full catalog at stratus-red-team.cloud/attack-techniques/list/

Review technique status

› stratus status

Example Stratus technique statuses
Technique ID	Technique name	Status
`aws.credential-access.ec2-get-password-data`	Retrieve EC2 Password Data	COLD
`aws.credential-access.ec2-steal-instance-credentials`	Steal EC2 Instance Credentials	COLD
`aws.credential-access.secretsmanager-batch-retrieve-secrets`	Retrieve a High Number of Secrets Manager secrets (Batch)	COLD
`aws.credential-access.ssm-retrieve-securestring-parameters`	Retrieve And Decrypt SSM Parameters	COLD
`aws.defense-evasion.cloudtrail-delete`	Delete CloudTrail Trail	COLD
`aws.defense-evasion.cloudtrail-event-selectors`	Disable CloudTrail Logging Through Event Selectors	COLD
`aws.defense-evasion.cloudtrail-stop`	Stop CloudTrail Trail	COLD
`aws.defense-evasion.organizations-leave`	Attempt to Leave the AWS Organization	COLD
`aws.defense-evasion.vpc-remove-flow-logs`	Remove VPC Flow Logs	COLD

Use this cheat sheet with AI

Copy a ready-to-use prompt into your preferred AI assistant.

Goal

Preview prompt

Prompt

Use this Cybr cheat sheet as reference: Simulate Cloud Attacks
Source: https://cybr.com/cheat-sheets/cloud-attack-simulations/

My goal: Guide me through a simulation

Help me practice cloud attack simulation in my lab using Atomic Red Team or Stratus Red Team. Ask about the lab environment and the detection I want to validate. Select a relevant technique, explain prerequisites and expected telemetry, then walk through preparation, execution, observation, reversion, and cleanup. Define what a successful detection test looks like.

Use the included reference material even if you cannot open the source URL. Ask for missing context rather than inventing my environment. Explain assumptions. For version-sensitive service behavior or commands, consult current official documentation when available, cite it, and explain any differences from this reference. If you cannot verify something, say so.

Reference material from the cheat sheet (structured text or a curated summary):

Atomic Red Team provides tests mapped to MITRE ATT&CK. Invoke-AtomicRedTeam supports reviewing details, checking prerequisites, and selecting tests; Atomic Runner can run a CSV sequence and clean up. Example: Invoke-AtomicTest T1003 -ShowDetailsBrief. Stratus Red Team provides cloud attack techniques with list, show, warmup, detonate, status, revert, and cleanup commands. The workflow is to inspect a technique, prepare prerequisites, execute it, observe detection, revert changes, and clean up. Examples on the sheet include CloudTrail logging changes and credential-access techniques.

More cheat sheets