---
title: "Simulate Cloud Attacks Cheat Sheet | Cybr"
description: "Use Atomic Red Team and Stratus Red Team to emulate real-world attack techniques and validate cloud defenses."
url: https://cybr.com/cheat-sheets/cloud-attack-simulations/
---

# Simulate Cloud Attacks

Validate security controls and detection coverage with repeatable adversary emulation.

 [Cybr](https://cybr.com/) [Christophe Limpalair](https://www.linkedin.com/in/christophelimpalair/)

![Atomic Red Team](https://cybr.com/cloud-attack-simulations/atomic-red-team.png)

## Red Canary’s Atomic Red Team™

A library of tests mapped to the MITRE ATT&CK® framework for testing cloud environments, containers, Microsoft 365, Linux, macOS, Windows, and more.

Getting started

- Install Invoke-AtomicRedTeam
- Import a module
- Check prerequisites
- List atomic tests

Review the details for a technique

```
› Invoke-AtomicTest T1003 -ShowDetailsBrief
```

Execute specific tests by atomic test number

```
› Invoke-AtomicTest T1218.010 -TestNumbers 1,2
```

Execute every test for a technique with a process timeout

```
› Invoke-AtomicTest T1218.010 -TimeoutSeconds 15
```

Emulate adversaries in sequence

Create a CSV list of atomic tests for Atomic Runner to execute.

List each test in the CSV file

```
› Invoke-AtomicRunner -listOfAtomics .\IcedID.csv -ShowDetailsBrief
```

Run the prerequisites command for each test

```
› Invoke-AtomicRunner -listOfAtomics .\IcedID.csv -GetPrereqs
```

Run each test

```
› Invoke-AtomicRunner -listOfAtomics .\IcedID.csv
```

Clean up after the tests

```
› Invoke-AtomicRunner -listOfAtomics .\IcedID.csv -Cleanup
```

![Stratus Red Team](https://cybr.com/cloud-attack-simulations/stratus-red-team.png)

## Datadog’s Stratus Red Team

“Atomic Red Team™” for the cloud, providing granular, self-contained offensive techniques for AWS, Azure, GCP, Microsoft Entra ID, and Kubernetes.

Explore the CLI

```
› stratus -h
```

`cleanup`Clean up leftover infrastructure or configuration

`completion`Generate an autocompletion script for your shell

`detonate`Detonate one or more attack techniques

`help`Show help for any command

`list`List attack techniques

`revert`Revert an attack technique

`show`Display details about an attack technique

`status`Display the status of techniques

`version`Display the current CLI version

`warmup`Create prerequisites without detonating the technique

Find an attack technique

```
› stratus list --platform aws --mitre-attack-tactic persistence
```

Browse the full catalog at [stratus-red-team.cloud/attack-techniques/list/](https://stratus-red-team.cloud/attack-techniques/list/)

Review technique status

```
› stratus status
```

Example Stratus technique statuses
| Technique ID | Technique name | Status |
| --- | --- | --- |
| `aws.credential-access.ec2-get-password-data` | Retrieve EC2 Password Data | **COLD** |
| `aws.credential-access.ec2-steal-instance-credentials` | Steal EC2 Instance Credentials | **COLD** |
| `aws.credential-access.secretsmanager-batch-retrieve-secrets` | Retrieve a High Number of Secrets Manager secrets (Batch) | **COLD** |
| `aws.credential-access.ssm-retrieve-securestring-parameters` | Retrieve And Decrypt SSM Parameters | **COLD** |
| `aws.defense-evasion.cloudtrail-delete` | Delete CloudTrail Trail | **COLD** |
| `aws.defense-evasion.cloudtrail-event-selectors` | Disable CloudTrail Logging Through Event Selectors | **COLD** |
| `aws.defense-evasion.cloudtrail-stop` | Stop CloudTrail Trail | **COLD** |
| `aws.defense-evasion.organizations-leave` | Attempt to Leave the AWS Organization | **COLD** |
| `aws.defense-evasion.vpc-remove-flow-logs` | Remove VPC Flow Logs | **COLD** |

## Use this cheat sheet with AI

Copy a ready-to-use prompt into your preferred AI assistant.

Goal

Preview prompt

Prompt

Sources and more info

[Invoke-AtomicRedTeam GitHub](https://github.com/redcanaryco/invoke-atomicredteam) [Atomic Red Team GitHub](https://github.com/redcanaryco/atomic-red-team) [Atomic Red Team website](https://atomicredteam.io/) [Stratus Red Team GitHub](https://github.com/DataDog/stratus-red-team) [Stratus Red Team website](https://stratus-red-team.cloud/)

**More cybersecurity cheat sheets** [cybr.com/cheat-sheets](https://cybr.com/cheat-sheets) **AWS security training** [cybr.com/courses](https://cybr.com/courses)

[More cheat sheets](https://cybr.com/cheat-sheets/)