--- title: "Simulate AWS Cloud Attacks with Real-World Techniques [Cheat Sheet] - Cybr" description: "Cheat sheet and tools you can use to simulate attacks against your cloud environments (AWS, Azure, GCP, Kubernetes) to test your defenses" url: https://cybr.com/cloud-security/simulate-aws-cloud-attacks-with-real-world-techniques/ --- # Simulate AWS Cloud Attacks with Real-World Techniques \[Cheat Sheet\] How can you tell if your threat detection measures are working in AWS? Or that your security controls and incident response playbooks are effective? One… Christophe Published March 19, 2024 · Updated June 18, 2024 How can you tell if your threat detection measures are working in AWS? Or that your security controls and incident response playbooks are effective? One effective approach is to simulate real-world attack techniques, and see if it detects them or works as expected! Sounds awesome, but how do I do that? Won’t that take a bunch of work? It definitely would if you started from scratch, but turns out there are some awesome open source tools that do exactly that. Let’s take a look at a few: - Red Canary’s Atomic Red Team™ - DataDog’s Stratus Red Team - Amazon’s GuardDuty tester Let’s take a closer look at each of these. ## 🔴 Red Canary’s Atomic Red Team™ [Atomic Red Team](https://github.com/redcanaryco/atomic-red-team) is — in a word — a beast. It’s an impressive library of tests that security teams can use to execute simulated adversarial attacks, which can help you identify whether your defenses are working as expected or not. It’s even mapped to [MITRE ATT&CK®](https://attack.mitre.org/). While this tool has multiple scenarios for cloud environments, it wasn’t specifically designed for the cloud. That’s where this next tool shines… ## 🔴 DataDog’s Stratus Red Team [Stratus Red Team](https://github.com/DataDog/stratus-red-team) *was* designed for the cloud and it includes tests for AWS, Azure, GCP, and Kubernetes. For example, to retrieve a bunch of secrets stored in Amazon’s Secrets Manager, you can detonate this module: ``` > stratus detonate aws.credential-access.secretsmanager-batch-retrieve-secrets ``` What’s most impressive about this tool (at least to me) is how it creates its own required changes to detonate a TTP, keeps track of state, and then cleans up the resources. This is a lot easier said than done and quite impressive of an implementation. ## 🔴 Amazon’s GuardDuty tester This one is a lot more specific because it’s really only focused on testing that you’ve successfully enabled Amazon GuardDuty in your environment(s) and it helps show examples of findings. Helpful, but limited and much more narrowly scoped than the prior two, and as compared to the rest of the list below. You can [check it out here](https://github.com/awslabs/amazon-guardduty-tester). ## Simulate Cloud Attacks Validate security controls and detection coverage with repeatable adversary emulation. [Cybr](https://cybr.com/) [Christophe Limpalair](https://www.linkedin.com/in/christophelimpalair/) ![Atomic Red Team](https://cybr.com/cloud-attack-simulations/atomic-red-team.png) ### Red Canary’s Atomic Red Team™ A library of tests mapped to the MITRE ATT&CK® framework for testing cloud environments, containers, Microsoft 365, Linux, macOS, Windows, and more. Getting started - Install Invoke-AtomicRedTeam - Import a module - Check prerequisites - List atomic tests Review the details for a technique ``` › Invoke-AtomicTest T1003 -ShowDetailsBrief ``` Execute specific tests by atomic test number ``` › Invoke-AtomicTest T1218.010 -TestNumbers 1,2 ``` Execute every test for a technique with a process timeout ``` › Invoke-AtomicTest T1218.010 -TimeoutSeconds 15 ``` Emulate adversaries in sequence Create a CSV list of atomic tests for Atomic Runner to execute. List each test in the CSV file ``` › Invoke-AtomicRunner -listOfAtomics .\IcedID.csv -ShowDetailsBrief ``` Run the prerequisites command for each test ``` › Invoke-AtomicRunner -listOfAtomics .\IcedID.csv -GetPrereqs ``` Run each test ``` › Invoke-AtomicRunner -listOfAtomics .\IcedID.csv ``` Clean up after the tests ``` › Invoke-AtomicRunner -listOfAtomics .\IcedID.csv -Cleanup ``` ![Stratus Red Team](https://cybr.com/cloud-attack-simulations/stratus-red-team.png) ### Datadog’s Stratus Red Team “Atomic Red Team™” for the cloud, providing granular, self-contained offensive techniques for AWS, Azure, GCP, Microsoft Entra ID, and Kubernetes. Explore the CLI ``` › stratus -h ``` `cleanup`Clean up leftover infrastructure or configuration `completion`Generate an autocompletion script for your shell `detonate`Detonate one or more attack techniques `help`Show help for any command `list`List attack techniques `revert`Revert an attack technique `show`Display details about an attack technique `status`Display the status of techniques `version`Display the current CLI version `warmup`Create prerequisites without detonating the technique Find an attack technique ``` › stratus list --platform aws --mitre-attack-tactic persistence ``` Browse the full catalog at [stratus-red-team.cloud/attack-techniques/list/](https://stratus-red-team.cloud/attack-techniques/list/) Review technique status ``` › stratus status ``` Example Stratus technique statuses | Technique ID | Technique name | Status | | --- | --- | --- | | `aws.credential-access.ec2-get-password-data` | Retrieve EC2 Password Data | **COLD** | | `aws.credential-access.ec2-steal-instance-credentials` | Steal EC2 Instance Credentials | **COLD** | | `aws.credential-access.secretsmanager-batch-retrieve-secrets` | Retrieve a High Number of Secrets Manager secrets (Batch) | **COLD** | | `aws.credential-access.ssm-retrieve-securestring-parameters` | Retrieve And Decrypt SSM Parameters | **COLD** | | `aws.defense-evasion.cloudtrail-delete` | Delete CloudTrail Trail | **COLD** | | `aws.defense-evasion.cloudtrail-event-selectors` | Disable CloudTrail Logging Through Event Selectors | **COLD** | | `aws.defense-evasion.cloudtrail-stop` | Stop CloudTrail Trail | **COLD** | | `aws.defense-evasion.organizations-leave` | Attempt to Leave the AWS Organization | **COLD** | | `aws.defense-evasion.vpc-remove-flow-logs` | Remove VPC Flow Logs | **COLD** | ### Use this cheat sheet with AI Copy a ready-to-use prompt into your preferred AI assistant. Goal Preview prompt Prompt Sources and more info [Invoke-AtomicRedTeam GitHub](https://github.com/redcanaryco/invoke-atomicredteam) [Atomic Red Team GitHub](https://github.com/redcanaryco/atomic-red-team) [Atomic Red Team website](https://atomicredteam.io/) [Stratus Red Team GitHub](https://github.com/DataDog/stratus-red-team) [Stratus Red Team website](https://stratus-red-team.cloud/) **More cybersecurity cheat sheets** [cybr.com/cheat-sheets](https://cybr.com/cheat-sheets) **AWS security training** [cybr.com/courses](https://cybr.com/courses) If you know anyone who needs to test their cloud defenses, don’t forget to share this with them! ## Filed under - [Cloud Security](https://cybr.com/cloud-security/) - [Red Team](https://cybr.com/red-team/) - [AWS](https://cybr.com/tag/aws/) - [AWS Security](https://cybr.com/tag/aws-security/) - [AWS Security Cheat Sheets](https://cybr.com/tag/aws-security-cheat-sheets/) - [Cheat Sheets](https://cybr.com/tag/cheat-sheets/) - [Cloud Security](https://cybr.com/tag/cloud-security/) - [Red Team](https://cybr.com/tag/red-team/) ## Comments Loading comments… Recommended resources [![Explore the AWS Certified Security Specialty course](https://media.cybr.com/2023/12/cybr-aws-security-specialty-banner-768x432.jpg)](https://cybr.com/courses/aws-certified-security-specialty-course/) ## Build practical AWS security skills Start with the core services, then prepare for the AWS Certified Security Specialty exam with guided lessons and hands-on practice. [Introduction to AWS Security](https://cybr.com/courses/introduction-to-aws-security/) [Security Specialty course](https://cybr.com/courses/aws-certified-security-specialty-course/)