Simulate AWS Cloud Attacks with Real-World Techniques [Cheat Sheet]

How can you tell if your threat detection measures are working in AWS? Or that your security controls and incident response playbooks are effective?

One effective approach is to simulate real-world attack techniques, and see if it detects them or works as expected!

Sounds awesome, but how do I do that? Won’t that take a bunch of work?

It definitely would if you started from scratch, but turns out there are some awesome open source tools that do exactly that. Let’s take a look at a few:

• Red Canary’s Atomic Red Team™
• DataDog’s Stratus Red Team
• Amazon’s GuardDuty tester

Let’s take a closer look at each of these.

🔴 Red Canary’s Atomic Red Team™

Atomic Red Team is — in a word — a beast. It’s an impressive library of tests that security teams can use to execute simulated adversarial attacks, which can help you identify whether your defenses are working as expected or not. It’s even mapped to MITRE ATT&CK®.

While this tool has multiple scenarios for cloud environments, it wasn’t specifically designed for the cloud. That’s where this next tool shines…

🔴 DataDog’s Stratus Red Team

Stratus Red Team was designed for the cloud and it includes tests for AWS, Azure, GCP, and Kubernetes.

For example, to retrieve a bunch of secrets stored in Amazon’s Secrets Manager, you can detonate this module:

> stratus detonate aws.credential-access.secretsmanager-batch-retrieve-secrets

What’s most impressive about this tool (at least to me) is how it creates its own required changes to detonate a TTP, keeps track of state, and then cleans up the resources. This is a lot easier said than done and quite impressive of an implementation.

🔴 Amazon’s GuardDuty tester

This one is a lot more specific because it’s really only focused on testing that you’ve successfully enabled Amazon GuardDuty in your environment(s) and it helps show examples of findings. Helpful, but limited and much more narrowly scoped than the prior two, and as compared to the rest of the list below. You can check it out here.

Simulate Cloud Attacks

Validate security controls and detection coverage with repeatable adversary emulation.

Cybr Christophe Limpalair

Red Canary’s Atomic Red Team™

A library of tests mapped to the MITRE ATT&CK® framework for testing cloud environments, containers, Microsoft 365, Linux, macOS, Windows, and more.

Getting started

• Install Invoke-AtomicRedTeam
• Import a module
• Check prerequisites
• List atomic tests

Review the details for a technique

› Invoke-AtomicTest T1003 -ShowDetailsBrief

Execute specific tests by atomic test number

› Invoke-AtomicTest T1218.010 -TestNumbers 1,2

Execute every test for a technique with a process timeout

› Invoke-AtomicTest T1218.010 -TimeoutSeconds 15

Emulate adversaries in sequence

Create a CSV list of atomic tests for Atomic Runner to execute.

List each test in the CSV file

› Invoke-AtomicRunner -listOfAtomics .\IcedID.csv -ShowDetailsBrief

Run the prerequisites command for each test

› Invoke-AtomicRunner -listOfAtomics .\IcedID.csv -GetPrereqs

Run each test

› Invoke-AtomicRunner -listOfAtomics .\IcedID.csv

Clean up after the tests

› Invoke-AtomicRunner -listOfAtomics .\IcedID.csv -Cleanup

Datadog’s Stratus Red Team

“Atomic Red Team™” for the cloud, providing granular, self-contained offensive techniques for AWS, Azure, GCP, Microsoft Entra ID, and Kubernetes.

Explore the CLI

› stratus -h

cleanupClean up leftover infrastructure or configuration

completionGenerate an autocompletion script for your shell

detonateDetonate one or more attack techniques

helpShow help for any command

listList attack techniques

revertRevert an attack technique

showDisplay details about an attack technique

statusDisplay the status of techniques

versionDisplay the current CLI version

warmupCreate prerequisites without detonating the technique

Find an attack technique

› stratus list --platform aws --mitre-attack-tactic persistence

Browse the full catalog at stratus-red-team.cloud/attack-techniques/list/

Review technique status

› stratus status

Example Stratus technique statuses

Technique ID	Technique name	Status
aws.credential-access.ec2-get-password-data	Retrieve EC2 Password Data	COLD
aws.credential-access.ec2-steal-instance-credentials	Steal EC2 Instance Credentials	COLD
aws.credential-access.secretsmanager-batch-retrieve-secrets	Retrieve a High Number of Secrets Manager secrets (Batch)	COLD
aws.credential-access.ssm-retrieve-securestring-parameters	Retrieve And Decrypt SSM Parameters	COLD
aws.defense-evasion.cloudtrail-delete	Delete CloudTrail Trail	COLD
aws.defense-evasion.cloudtrail-event-selectors	Disable CloudTrail Logging Through Event Selectors	COLD
aws.defense-evasion.cloudtrail-stop	Stop CloudTrail Trail	COLD
aws.defense-evasion.organizations-leave	Attempt to Leave the AWS Organization	COLD
aws.defense-evasion.vpc-remove-flow-logs	Remove VPC Flow Logs	COLD

Use this cheat sheet with AI

Copy a ready-to-use prompt into your preferred AI assistant.

Goal Guide me through a simulationExplain the tools and workflow

Copy prompt

Preview prompt

Prompt Use this Cybr cheat sheet as reference: Simulate Cloud Attacks Source: https://cybr.com/cheat-sheets/cloud-attack-simulations/ My goal: Guide me through a simulation Help me practice cloud attack simulation in my lab using Atomic Red Team or Stratus Red Team. Ask about the lab environment and the detection I want to validate. Select a relevant technique, explain prerequisites and expected telemetry, then walk through preparation, execution, observation, reversion, and cleanup. Define what a successful detection test looks like. Use the included reference material even if you cannot open the source URL. Ask for missing context rather than inventing my environment. Explain assumptions. For version-sensitive service behavior or commands, consult current official documentation when available, cite it, and explain any differences from this reference. If you cannot verify something, say so. Reference material from the cheat sheet (structured text or a curated summary): Atomic Red Team provides tests mapped to MITRE ATT&CK. Invoke-AtomicRedTeam supports reviewing details, checking prerequisites, and selecting tests; Atomic Runner can run a CSV sequence and clean up. Example: Invoke-AtomicTest T1003 -ShowDetailsBrief. Stratus Red Team provides cloud attack techniques with list, show, warmup, detonate, status, revert, and cleanup commands. The workflow is to inspect a technique, prepare prerequisites, execute it, observe detection, revert changes, and clean up. Examples on the sheet include CloudTrail logging changes and credential-access techniques.

If you know anyone who needs to test their cloud defenses, don’t forget to share this with them!