Stratus Red Team

No entries match these filters. Clear filters

1. v2.37.2 Oct 28, 2026 · issue 124
   └──▷ GET THIS VERSIONDockerGogit

   Docker copy

   $ docker pull ghcr.io/datadog/stratus-red-team:v2.37.2

   Go copy

   $ go install github.com/datadog/stratus-red-team/v2/cmd/stratus@v2.37.2

   git copy

   $ git clone --branch v2.37.2 https://github.com/DataDog/stratus-red-team.git
   # already have the repo? check out this version:
   $ git checkout v2.37.2

   published under the project's GitHub account · Go module path matches the repo · checked 29 Oct

   • New detection EBS Volume Cross-Account Sharing Exfiltration Technique
2. docs update Oct 1, 2026 · issue 091
   • New detection Create an EC2 Key Pair with a Suspicious Name
3. docs update Oct 1, 2026 · issue 091
   • New detection Create an EC2 Key Pair with a Suspicious Name
4. docs update Oct 1, 2026 · issue 091
   • New detection Create an EC2 Key Pair with a Suspicious Name
5. v2.37.0 Sep 30, 2026 · issue 091

   Stratus Red Team v2.37.0 adds a new AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. suspicious keypair persistence technique and improves S3 ransomware detonation reliability.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.37.0 https://github.com/DataDog/stratus-red-team.git
   # already have the repo? check out this version:
   $ git checkout v2.37.0

   └──▷ TRY IT
   Emulate an attacker planting a persistence EC2 key pair with a suspicious name to validate detection of ec2:CreateKeyPair with generic key names.
   copy

   $ stratus detonate aws.persistence.ec2-create-suspicious-keypair

   Emulate client-side S3 ransomware encryption against a fresh bucket (where SSE-CSSE-CAn Amazon S3 encryption mode where the caller supplies their own AES-256 key per request; S3 encrypts and immediately discards the key, so AWS never stores it. was previously blocked by default) to validate detection of PutBucketEncryption and abnormal object overwrite patterns.
   copy

   $ stratus detonate aws.impact.s3-ransomware-client-side-encryption

   • Adds aws.persistence.ec2-create-suspicious-keypair technique, simulating attacker persistence via ec2:CreateKeyPair with a short generic name (xg1), preceded by an ec2:DescribeInstances recon call filtered by key name; mapped to MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. T1098.001 (Account Manipulation: Additional Cloud Credentials) with no prerequisite Terraform infrastructure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Improves the aws.impact.s3-ransomware-client-side-encryption technique to allow SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates.-C on target buckets before detonation by calling PutBucketEncryption with BlockedEncryptionTypes set to NONE, enabling CopyObject with customer-provided keys to succeed on new buckets that block SSE-C by default.
   • Adds aws.persistence.ec2-create-suspicious-keypair technique, simulating attacker persistence via ec2:CreateKeyPair with a short generic name (xg1), preceded by an ec2:DescribeInstances recon call filtered by key name; mapped to MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. T1098.001 (Account Manipulation: Additional Cloud Credentials) with no prerequisite Terraform infrastructure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

6. v2.36.1 Sep 22, 2026 · issue 083

   Stratus Red Team v2.36.1 adds concurrent detonation support across all providers, KUBECONFIG multi-path handling, and Azure correlation ID propagation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.36.1 https://github.com/DataDog/stratus-red-team.git
   # already have the repo? check out this version:
   $ git checkout v2.36.1

   • Propagates Azure correlation IDs via clientRequestID (migrated from user-agent) so detonation activity is traceable across Azure API calls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Enables concurrent detonation across all providers (AWS, Azure, GCP, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., Kubernetes, EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves.) by embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. a short correlation ID (var.correlation.short) in Terraform-managed resource names, preventing resource collisions when multiple users share an environment.
   • Removes dependency on the az CLI by bumping the Azure (azurerm) Terraform provider to 4.81.0.
   • Adds opt-out of the Terraform cache to prevent concurrency issues during parallel detonations.
   • Propagates Azure correlation IDs via clientRequestID (migrated from user-agent) so detonation activity is traceable across Azure API calls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   3 more in Everything

7. docs update Aug 18, 2026 · issue 049

   Stratus Red Team adds Deregister an Amazon EC2 AMI attack technique for AWS.

8. docs update Aug 18, 2026 · issue 049

   Stratus Red Team adds Deregister an Amazon EC2 AMI attack technique to its MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. coverage.

9. docs update Aug 18, 2026 · issue 049

   Stratus Red Team adds execution isolation via STRATUS_RED_TEAM_CORRELATION_ID for safe concurrent attack technique runs

   └──▷ TRY IT
   Run two isolated detonate-and-cleanup cycles of the same technique in parallel without them sharing Terraform state.
   copy

   $ export STRATUS_RED_TEAM_CORRELATION_ID=$(uuidgen)
   stratus detonate aws.persistence.iam-backdoor-user
   stratus cleanup aws.persistence.iam-backdoor-user

   Embed the short correlation ID in Terraform resource names so two concurrent executions request distinct cloud resources and never collide.
   hcl copy

   locals {
     resource_prefix = "stratus-red-team-my-technique-${var.correlation.short}"
   }

   Check the state of an isolated execution — without the correlation ID the technique appears COLD even though it is WARM under the execution's directory.
   copy

   $ # Reports COLD (flat layout, no isolated state visible)
   stratus status aws.persistence.iam-backdoor-user
   
   # Reports WARM (scoped to this execution's directory)
   STRATUS_RED_TEAM_CORRELATION_ID=$ID stratus status aws.persistence.iam-backdoor-user

   • Adds STRATUS_RED_TEAM_CORRELATION_ID environment variable to isolate each execution's Terraform state under $HOME/.stratus-red-team/<technique-id>/<correlation-id>, preventing concurrent runs from sharing or destroying each other's resources.
   • Adds runner.WithCorrelationID(id) to the Go library for passing a correlation ID when using Stratus Red Team programmatically.
   • Exposes var.correlation.short (8-character form) and var.correlation.id (full form) as Terraform variables for technique authors to embed correlation IDs in cloud resource names, enabling true concurrent execution of the same technique.
   • Exposes stratus.CorrelationShortID(providers.AWS().UniqueCorrelationId) in Go for accessing the short correlation ID from technique code.
   • Adds a shared Terraform provider plugin cache at $HOME/.stratus-red-team/plugin-cache, so provider plugins are downloaded once and reused across executions rather than re-downloaded per run.

   +2 more show less

   • The stratus status command now scopes its report to a specific execution when STRATUS_RED_TEAM_CORRELATION_ID is set, and falls back to the flat per-technique directory when the variable is unset.
   • Includes automatic migration of existing flat state into the per-execution directory when the recorded correlation ID matches the one passed, requiring no manual action for upgrades from earlier versions.

   7 details in Everything

10. docs update Aug 18, 2026 · issue 049

    Stratus Red Team adds Deregister an Amazon EC2 AMI attack technique to its library.

11. docs update Aug 18, 2026 · issue 049

    Stratus Red Team adds tags and prefix config settings for AWS technique prerequisites, enabling custom tagging and resource-name prefixing.

    • Adds tags config setting to apply custom tags (via AWS provider default_tags) to Terraform-managed prerequisites for AWS techniques — enabling correlation IDs, ownership labels, and environment markers per technique.
    • Adds prefix config setting to prepend a custom string (with templating support) to the names of Terraform-managed prerequisite resources for AWS techniques.

    2 details in Everything

12. v2.36.0 Aug 18, 2026 · issue 049

    Stratus Red Team v2.36.0 adds EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. AMI deregistration, concurrent execution isolation via correlation ID, and configurable AWS resource tags/prefixes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.36.0 https://github.com/DataDog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.36.0

    └──▷ TRY IT
    Run two parallel red-team sessions in the same AWS environment without state collisions by assigning each a unique correlation ID.
    copy

    $ STRATUS_RED_TEAM_CORRELATION_ID=session-alpha stratus detonate aws.impact.ec2-deregister-ami

    • Adds STRATUS_RED_TEAM_CORRELATION_ID environment variable to isolate concurrent attack-technique executions in the same environment, preventing errors and duplicate state.
    • Adds configurable AWS resource tags and prefixes for resources created during warmup, controlled via the Stratus Red Team configuration file.
    • New attack technique aws.impact.ec2-deregister-ami: deregisters an Amazon EC2 AMI to simulate disruption.

    3 details in Everything

13. docs update Aug 1, 2026 · issue 032

    Stratus Red Team adds attack technique for enabling local auth and exfiltrating Azure AI Foundry API keys

    • Adds new attack technique: Enable Local Authentication and Exfiltrate Azure AI Foundry API Keys, extending MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. coverage to Azure AI Foundry credential theft scenarios.

    1 detail in Everything

14. docs update Aug 1, 2026 · issue 032

    Stratus Red Team adds Azure AI Foundry attack technique covering local auth enablement and API key exfiltration.

    • New attack technique: Enable Local Authentication and Exfiltrate Azure AI Foundry API Keys covering Persistence and Credential Access tactics against Azure AI Foundry.

    1 detail in Everything

15. v2.35.0 Jul 31, 2026 · issue 032

    Adds new Azure attack technique to emulate AI Foundry API key exfiltration via local auth re-enablement.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.35.0 https://github.com/DataDog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.35.0

    └──▷ TRY IT
    Emulate an attacker re-enabling local auth on an Azure AI Foundry account and exfiltrating its API keys — useful for validating detections on Azure Cognitive Services key-listing activity.
    copy

    $ stratus detonate azure.persistence.exfiltrate-foundry-key

    • New Azure technique azure.persistence.exfiltrate-foundry-key: re-enables local (key-based) authentication on an Azure AI Foundry (Cognitive Services) account and retrieves API keys via ListKeys, emulating a Persistence/Credential Access attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The azure.persistence.exfiltrate-foundry-key technique requires the ARM_SUBSCRIPTION_ID environment variable (not AZURE_SUBSCRIPTION_ID) due to an upgrade to the azurerm Terraform provider 4.80.0.
16. v2.34.0 Jul 10, 2026 · issue 012

    Stratus Red Team v2.34.0 adds Azure App Service credential harvesting, a controllable logger API, and a threat-intel coverage mapping skill.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.34.0 https://github.com/DataDog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.34.0

    └──▷ USE IT
    Route all Stratus library log output through your own zap logger instead of the default stdout handler — useful when embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. Stratus in a larger tool.
    go copy

    import (
        "log/slog"
        stratuslog "github.com/datadog/stratus-red-team/v2/pkg/stratus/log"
        "go.uber.org/zap"
        "go.uber.org/zap/exp/zapslog"
    )
    
    func init() {
        zapLogger, _ := zap.NewProduction()
        handler := zapslog.NewHandler(zapLogger.Core(), zapslog.WithCaller(false))
        stratuslog.SetLogger(slog.New(handler))
    }

    • New Azure attack technique: Retrieve App Service Publishing Credentials (azure.credential-access.app-service-publishing-credentials).
    • New pkg/stratus/log package exposes a controllable logger, letting library embedders route Stratus log output through any slog.Handler (e.g., zap, logrus).
    • New map-threat-intel-coverage agent skill fetches a threat-intelligence report, extracts cloud TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind., classifies each against existing Stratus Red Team coverage, and drafts GitHub issues for gaps.

    3 details in Everything

17. v2.33.0 Jun 4, 2026 · release notes

    Stratus Red Team v2.33.0 adds two Azure Blob Storage ransomware attack techniques targeting encryption key destruction.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.33.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.33.0

    └──▷ TRY IT
    Detonate the CPEK ransomware technique to test detection of encryption key substitution attacks against Azure Blob Storage.
    copy

    $ stratus detonate azure.impact.blob-ransomware-cpek

    Detonate the CMK vault deletion ransomware technique to validate alerting when an attacker destroys the Key Vault protecting Blob Storage.
    copy

    $ stratus detonate azure.impact.blob-ransomware-service-storage-cmk

    • New attack technique: simulate Azure Blob Storage ransomware via Customer-Provided Encryption Keys (CPEK).
    • New attack technique: simulate Azure Blob Storage ransomware via Customer-Managed Key Vault key and vault deletion.

    2 details in Everything

18. v2.32.1 May 20, 2026 · release notes

    Stratus Red Team v2.32.1 shrinks binary size ~50% and adds detonation ID templating in config files.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.32.1 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.32.1

    └──▷ USE IT
    Inject the detonation ID into a Kubernetes pod label via the config file to correlate attack simulation runs with cluster activity.
    yaml copy

    # Example stratus config snippet using detonation ID templating
    detonation_id: "{{ .DetonationID }}"
    pod_labels:
      stratus-detonation: "{{ .DetonationID }}"

    • Enables detonation ID templating in the Stratus Red Team configuration file, e.g. for injecting the ID into Kubernetes pod labels.
    • Reduces the Stratus Red Team binary size by roughly 50%, lowering download and deployment overhead.

    2 details in Everything

19. v2.32.0 May 20, 2026 · release notes

    Stratus Red Team v2.32.0 adds three new GCP attack techniques including Vertex AI abuse and GCS ransomware simulations.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.32.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.32.0

    └──▷ TRY IT
    Simulate a GCS ransomware attack using client-side encryption to test your GCP data-protection and alerting controls.
    copy

    $ stratus detonate gcp.impact.gcs-ransomware-client-side-encryption

    Test detection of malicious Vertex AI Workbench startup script injection in your GCP environment.
    copy

    $ stratus detonate gcp.execution.modify-vertex-notebook-startup

    Simulate GCS ransomware via individual file deletion to validate object-level audit log alerting.
    copy

    $ stratus detonate gcp.impact.gcs-ransomware-individual-deletion

    • New GCP technique: Inject a Malicious Startup Script into a Vertex AI Workbench Instance (gcp.execution.modify-vertex-notebook-startup).
    • New GCP technique: GCS Ransomware through individual file deletion (gcp.impact.gcs-ransomware-individual-deletion).
    • New GCP technique: GCS Ransomware through client-side encryption (gcp.impact.gcs-ransomware-client-side-encryption).
    • Kubernetes resources are now labeled with datadoghq.com/stratus-red-team-stage=warmup|detonation to distinguish warmup from detonation resources.
    • Kubernetes configuration now supports pod annotations.

    5 details in Everything

20. v2.31.0 Apr 14, 2026 · release notes

    Stratus Red Team v2.31.0 adds 9 new attack techniques across Azure, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., and GCP plus expanded programmatic runner options.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.31.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.31.0

    └──▷ TRY IT
    Simulate a GCP attacker disabling audit logs to blind your SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. — useful for testing detection coverage of log-tampering TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind..
    copy

    $ stratus detonate gcp.defense-evasion.disable-audit-logs

    Test whether your Azure identity governance controls catch a backdoored Managed Identity being granted an external Federated Identity Credential.
    copy

    $ stratus detonate azure.persistence.backdoor-managed-identity-fic

    Test your Entra ID application-layer detection by adding a rogue Federated Identity Credential to a service principal.
    copy

    $ stratus detonate entra-id.persistence.backdoor-application-fic

    • Adds Azure persistence technique: Backdoor Azure Managed Identity with Federated Identity Credential (FIC).
    • Adds Entra ID persistence technique: Backdoor Entra ID application with Federated Identity Credential (FIC).
    • Adds GCP defense-evasion technique: Attempt to Remove a GCP Project from its Organization.
    • Adds GCP defense-evasion technique: Delete a Cloud DNS Logging Policy.
    • Adds GCP defense-evasion technique: Disable Data Access Audit Logs for a GCP Service.

    +8 more show less

    • Adds GCP defense-evasion technique: Disable VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Flow Logs on a Subnet.
    • Adds GCP defense-evasion technique: Disable a GCP Log Sink.
    • Adds GCP discovery technique: Read GCEGCEGoogle Compute Engine, Google's infrastructure-as-a-service platform for running virtual machines in the cloud; cyber tools use it for scalable, on-demand compute without managing physical hardware. Instance Metadata via the Compute API.
    • Adds GCP defense-evasion technique: Reduce Log Retention Period on a Cloud Logging Sink Bucket.
    • Programmatic usage now supports an S3 bucket for internal and Terraform state storage.
    • Programmatic usage now supports custom StateManager, TerraformManager, ProviderFactory, Config, and CorrelationID when launching the runner.
    • Programmatic usage now supports supplying an existing Terraform binary instead of downloading its own.
    • Programmatic usage now supports configurable cloud credentials rather than relying on environment variables.

    13 details in Everything

21. v2.30.0 Mar 26, 2026 · release notes

    Stratus Red Team v2.30.0 adds YAML configuration file support for persistent CLI settings.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.30.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.30.0

    └──▷ TRY IT
    Persist default settings (e.g., AWS region, output format) in a config file so every stratus command picks them up automatically.
    copy

    $ # Create ~/.stratus-red-team.yaml with your defaults, then run attacks without repeating flags
    stratus detonate aws.credential-access.ec2-get-password-data

22. v2.29.0 Mar 9, 2026 · release notes

    Stratus Red Team v2.29.0 adds an Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. attack technique to elevate privileges to User Access Administrator at root scope.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.29.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.29.0

23. v2.27.0 Feb 12, 2026 · release notes

    Stratus Red Team v2.27.0 adds four new GCP attack techniques covering compute abuse, credential theft, and permission enumeration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.27.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.27.0

    └──▷ TRY IT
    Detonate the multi-zone GCEGCEGoogle Compute Engine, Google's infrastructure-as-a-service platform for running virtual machines in the cloud; cyber tools use it for scalable, on-demand compute without managing physical hardware. instance creation technique to test detection of compute resource abuse at scale across regions.
    copy

    $ stratus detonate gcp.impact.create-instances-in-multiple-zones

    Simulate an attacker using a stolen GCE default service account token from outside GCP to validate credential-theft detections.
    copy

    $ stratus detonate gcp.initial-access.use-compute-sa-outside-gcp

    Emulate post-compromise service account permission enumeration to test discovery-phase alerting in GCP.
    copy

    $ stratus detonate gcp.discovery.enumerate-permissions

    • New GCP technique: simulate cryptomining-style impact by creating GCE instances across multiple zones (gcp.impact.create-instances-in-multiple-zones).
    • New GCP technique: create a GCE GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. virtual machine instance to emulate GPU-hungry workload abuse (gcp.impact.create-gpu-vm).
    • New GCP technique: steal and replay a GCE default service account token from outside Google Cloud to simulate initial access (gcp.initial-access.use-compute-sa-outside-gcp).
    • New GCP technique: enumerate all permissions of a GCP service account to simulate post-compromise discovery (gcp.discovery.enumerate-permissions).

    4 details in Everything

24. v2.26.0 Feb 10, 2026 · release notes

    Stratus Red Team v2.26.0 adds Azure Blob Storage ransomware and GCP SSH key injection attack techniques.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.26.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.26.0

    └──▷ TRY IT
    Detonate the Azure Blob Storage ransomware technique in a lab environment to validate detections for client-managed key abuse.
    copy

    $ stratus detonate azure.impact.blob-ransomware-client-encryption-scope

    Simulate an attacker registering an SSH key to GCP instance metadata to test lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. detections.
    copy

    $ stratus detonate gcp.lateral-movement.add-sshkey-instance-metadata

    • New Azure attack technique: simulate Blob Storage ransomware via Encryption Scope using a client-managed Key Vault key (azure.impact.blob-ransomware-client-encryption-scope).
    • New GCP attack technique: register an SSH public key to instance metadata for lateral movement simulation (gcp.lateral-movement.add-sshkey-instance-metadata).

    2 details in Everything

25. v2.25.0 Feb 4, 2026 · release notes

    Stratus Red Team v2.25.0 adds three new Azure attack techniques covering storage exfiltration and resource lock deletion.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.25.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.25.0

    • New technique: Exfiltrate Azure Storage via public access (azure.exfiltration.storage-public-access)
    • New technique: Exfiltrate Azure Storage through SAS URL (azure.exfiltration.storage-sas-export)
    • New technique: Delete Azure resource lock (azure.impact.resource-lock)

    3 details in Everything

26. v2.24.0 Feb 4, 2026 · release notes

    Stratus Red Team v2.24.0 adds Azure blob ransomware simulation and AWS SageMaker command execution techniques.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.24.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.24.0

    └──▷ TRY IT
    Test your Azure blob storage ransomware detection by simulating individual file deletions across a Storage Account.
    copy

    $ stratus detonate azure.impact.blob-ransomware-individual-file-deletion

    Validate detection of adversary command execution on SageMaker by abusing Lifecycle Configurations to run code on a notebook instance.
    copy

    $ stratus detonate aws.execution.sagemaker-update-lifecycle-config

    • New attack technique: simulate Azure ransomware via Storage Account Blob deletion (azure.impact.blob-ransomware-individual-file-deletion).
    • New attack technique: execute commands on an AWS SageMaker Notebook Instance via Lifecycle Configuration (aws.execution.sagemaker-update-lifecycle-config).

    2 details in Everything

27. v2.23.0 Feb 14, 2025 · release notes

    Stratus Red Team v2.23.0 adds a GCP attack technique to mass-retrieve Secret Manager secrets.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.23.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.23.0

    └──▷ TRY IT
    Detonate the new GCP Secret Manager bulk-retrieval technique to test whether your detection engineering catches mass secret access.
    copy

    $ stratus detonate gcp.credential-access.secretmanager-retrieve-secrets

    • New GCP credential-access technique: simulate bulk retrieval of a high number of Secret Manager secrets (gcp.credential-access.secretmanager-retrieve-secrets).

    1 detail in Everything

28. v2.20.0 Dec 4, 2024 · release notes

    Stratus Red Team v2.20.0 adds two new AWS attack techniques for EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. serial console abuse and STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets. federation token persistence.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.20.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.20.0

    └──▷ TRY IT
    Detonate the EC2 serial console SSH key injection technique to test lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. detections in your AWS environment.
    copy

    $ stratus detonate aws.lateral-movement.ec2-serial-console-send-ssh-public-key

    Detonate the STS federation token technique to validate persistence detections for temporary credential generation.
    copy

    $ stratus detonate aws.persistence.sts-federation-token

    • New attack technique: simulate lateral movement via EC2 Serial Console by pushing an SSH public key to multiple instances using SendSerialConsoleSSHPublicKey.
    • New attack technique: simulate persistence by generating temporary AWS credentials with GetFederationToken via STS federation.

    2 details in Everything

29. v2.19.0 Oct 21, 2024 · release notes

    Stratus Red Team v2.19.0 adds an Azure attack technique for VM access via Bastion shareable links.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.19.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.19.0

    └──▷ TRY IT
    Detonate the new Azure Bastion shareable link technique to test detection of unauthorized VM lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. via Bastion.
    copy

    $ stratus detonate azure.create-bastion-shareable-link

30. v2.18.0 Oct 18, 2024 · release notes

    Stratus Red Team v2.18.0 adds a new AWS attack technique for invoking Bedrock models.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.18.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.18.0

    └──▷ TRY IT
    Detonate the Bedrock model invocation technique to test detection coverage for AI/ML service abuse in AWS.
    copy

    $ stratus detonate aws.impact.bedrock-invoke-model

    • New attack technique aws.impact.bedrock-invoke-model simulates adversarial invocation of AWS Bedrock models.

    1 detail in Everything

31. v2.17.0 Sep 17, 2024 · release notes

    Stratus Red Team v2.17.0 adds Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. attack techniques and a new AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. login profile attack.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.17.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.17.0

    └──▷ TRY IT
    Detonate the new AWS IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. login profile update technique to simulate an attacker gaining console access by overwriting a victim user's password.
    copy

    $ stratus detonate aws.credential-access.update-iam-user-login-profile

    • Adds Microsoft Entra ID attack techniques, expanding adversary simulation coverage to Azure identity infrastructure.
    • New AWS attack technique: Update IAM user login profile (aws.credential-access.update-iam-user-login-profile), simulating credential takeover via console access manipulation.

    2 details in Everything

32. v2.16.0 Aug 2, 2024 · release notes

    Stratus Red Team v2.16.0 adds initial EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. attack technique support for Kubernetes-on-AWS adversary simulation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.16.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.16.0

    • Adds initial support for EKS attack techniques, enabling adversary simulation against Amazon Elastic Kubernetes Service environments.
    • Allows specifying a context when instantiating Stratus Red Team runners, propagating it down to Terraform for more flexible programmatic use.

    2 details in Everything

33. v2.15.0 Apr 8, 2024 · release notes

    Adds aws.discovery.ses-enumerate attack technique for SES enumeration activities

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.15.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.15.0

    └──▷ USE IT
    Run the new SES enumeration technique against your AWS environment
    shell copy

    stratus red aws.discovery.ses-enumerate

    • Improves error messaging when an AWS region is not configured

    1 detail in Everything

34. v2.14.0 Feb 9, 2024 · release notes

    Stratus Red Team v2.14.0 adds four new AWS attack techniques

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.14.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.14.0

    └──▷ USE IT
    Launch the new DNS log deletion attack via the CLI.
    shell copy

    stratus execute aws.defense-evasion.dns-delete-logs

    Deploy a backdoored IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role for persistence testing.
    shell copy

    stratus execute aws.persistence.iam-create-backdoor-role

    • Adds aws.defense-evasion.dns-delete-logs technique to delete DNS query logs in AWS.
    • Adds aws.execution.ssm-start-session technique for launching SSM StartSession on multiple instances.
    • Adds aws.persistence.iam-create-backdoor-role technique to create a backdoored IAM Role.
    • Adds aws.execution.ssm-send-command technique for using ssm:SendCommand on multiple instances.

    4 details in Everything

35. v2.13.0 Jan 30, 2024 · release notes

    Stratus Red Team v2.13.0 adds the ec2instanceconnect:SendSSHPublicKey technique to multiple instances

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.13.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.13.0

    └──▷ USE IT
    Execute lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. via EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. Instance Connect to inject SSH keys across a fleet.
    shell copy

    ./stratus-red-team attack aws.lateral-movement.ec2-send-ssh-public-key --targets <instance_ids>

36. v2.12.0 Nov 29, 2023 · release notes

    Stratus Red Team v2.12.0 adds new GCP attack techniques for exfiltrating Compute Images and Disks via sharing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.12.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.12.0

    • Adds the gcp.exfiltration.share-compute-image technique to exfiltrate Compute Images by sharing them
    • Adds the gcp.exfiltration.share-compute-snapshot technique to exfiltrate Compute Disks by sharing a snapshot

    2 details in Everything

37. v2.11.0 Nov 27, 2023 · release notes

    Stratus Red Team v2.11.0 adds secretsmanager-batch-retrieve-secrets attack technique leveraging AWS BatchGetSecretValue.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.11.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.11.0

    • Adds the AWS/aws.credential-access.secretsmanager-batch-retrieve-secrets technique to dump secrets via Secret Manager's BatchGetSecretValue API

    1 detail in Everything

38. v2.9.0 Aug 25, 2023 · release notes

    Stratus Red Team v2.9.0 adds 3 new AWS S3 ransomware attack techniques

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.9.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.9.0

    └──▷ USE IT
    Simulate an attacker encrypting S3 objects using client-side encryption logic
    shell copy

    stratus red aws.impact.s3-ransomware-client-side-encryption detonate

    Simulate mass deletion of S3 files to mimic ransomware data destruction
    shell copy

    stratus red aws.impact.s3-ransomware-batch-deletion detonate

    Simulate individual file deletion as part of a ransomware attack simulation
    shell copy

    stratus red aws.impact.s3-ransomware-individual-deletion detonate

    • aws.impact.s3-ransomware-individual-deletion technique to simulate ransomware by deleting S3 files individually
    • aws.impact.s3-ransomware-batch-deletion technique to simulate ransomware by deleting S3 files in batch
    • aws.impact.s3-ransomware-client-side-encryption technique to simulate ransomware via client-side encryption of S3 objects

    3 details in Everything

39. v2.8.0 Jun 27, 2023 · release notes

    Stratus Red Team v2.8.0 adds a new GCP persistence technique to backdoor a service account via its IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policy.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.8.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.8.0

    • Adds GCP/gcp.persistence.backdoor-service-account-policy attack technique to the CLI for testing IAM misconfigurations

    1 detail in Everything

40. v2.6.0 Jun 20, 2023 · release notes

    Stratus Red Team v2.6.0 adds GCP compute disk exfiltration technique

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.6.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.6.0

    └──▷ TRY IT
    Execute the new GCP disk exfiltration attack in a controlled environment.
    copy

    $ stratus red gcp.exfiltration.share-compute-disk execute

41. v2.5.4 May 3, 2023 · release notes

    Stratus Red Team v2.5.4 auto-installs shell completions via Homebrew

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.4 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.5.4

42. v2.4.9 Nov 22, 2022 · release notes

    Stratus Red Team v2.4.9 adds YAML generation for available attack techniques via make docs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.9 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.4.9

    └──▷ TRY IT
    Generate a YAML inventory of all available Stratus Red Team attack techniques.
    copy

    $ make docs

43. v2.3.0 Aug 13, 2022 · release notes

    Stratus Red Team v2.3.0 adds GCP support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.3.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.3.0

    • GCP is now a supported cloud provider for executing red team techniques.

    1 detail in Everything

44. v2.2.0 Jul 13, 2022 · release notes

    Stratus Red Team v2.2.0 adds three new AWS and Kubernetes attack techniques.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.2.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.2.0

    • AWS aws.persistence.rolesanywhere-create-trust-anchor: Create an IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Roles Anywhere trust anchor
    • AWS aws.execution.ec2-launch-unusual-instances: Launch Unusual EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. Instances
    • K8s k8s.persistence.create-token: Create Long-Lived Token

    3 details in Everything

45. v2.1.0 Jun 20, 2022 · release notes

    Stratus Red Team v2.1 adds three new attack techniques and CLI autocomplete

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.1.0

    • azure.exfiltration.disk-export technique exports a disk via Shared Access Signature URL
    • azure.execution.vm-custom-script-extension technique executes commands on VMs using Custom Script Extension
    • aws.persistence.lambda-overwrite-code technique overwrites Lambda function code for persistence
    • Dynamic CLI autocomplete is now available for all attack techniques

    4 details in Everything

46. v2.0.0 Jun 3, 2022 · release notes

    Stratus Red Team v2.0.0 adds Azure cloud support and a new VM Run Command attack technique.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v2.0.0

    • Adds Azure cloud provider support as a target platform for attack simulation
    • Introduces the azure.execution.vm-run-command technique to execute commands on Azure Virtual Machines
    • Upgrades the base Go runtime from 1.17 to 1.18

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The programmatic interface may break for users running the Stratus Red Team binary built with the new Go 1.18 runtime on environments that require Go 1.17.
47. v1.7.0 Apr 6, 2022 · release notes

    Stratus Red Team v1.7.0 adds unique UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. in User-Agent header for execution tracking

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v1.7.0

    • User-Agent headers for Kubernetes and AWS API requests now include a unique stratus-red-team_<uuid> identifier

    1 detail in Everything

48. v1.5.0 Feb 28, 2022 · release notes

    Stratus Red Team v1.5.0 adds the k8s.credential-access.dump-secrets attack technique to dump Kubernetes cluster secrets.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v1.5.0

    └──▷ TRY IT
    Execute the new technique to dump all secrets within a Kubernetes cluster.
    copy

    $ stratus execute k8s.credential-access.dump-secrets

49. v1.4.0 Feb 10, 2022 · release notes

    v1.4.0 adds three new K8s attack techniques and parallelizes warmup, detonate and cleanup for multi-technique runs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v1.4.0

    • Adds k8s.privilege-escalation.privileged-pod attack technique to spawn a privileged Kubernetes pod.
    • Adds k8s.persistence.create-admin-clusterrole attack technique to create an admin ClusterRole in Kubernetes.
    • Adds k8s.credential-access.steal-serviceaccount-token attack technique to steal a pod service account token in Kubernetes.
    • Parallelizes command execution when running stratus warmup, stratus detonate, or stratus cleanup on multiple attack techniques simultaneously.

    4 details in Everything

50. v1.2.0 Feb 2, 2022 · release notes

    Stratus Red Team v1.2.0 adds AWS aws.discovery.ec2-download-user-data technique and detection docs to attack pages.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.0 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v1.2.0

    • Attack technique pages now include auto-generated detection documentation

    1 detail in Everything

51. v0.0.20 Jan 25, 2022 · release notes

    Stratus Red Team v0.0.20 adds three new AWS attack techniques and custom user-agent support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.20 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v0.0.20

    └──▷ USE IT
    Execute a new technique to exfiltrate an RDS snapshot in a red team exercise.
    shell copy

    stratus launch aws.rds.exfiltrate-rds-snapshot

    Run a technique to retrieve and decrypt SSM parameters for credential harvesting.
    shell copy

    stratus launch aws.ssm.retrieve-and-decrypt-ssm-parameters

    • Adds Disable CloudTrail Logging Through Event Selectors attack technique
    • Adds Exfiltrate an RDS snapshot attack technique
    • Adds Retrieve And Decrypt SSM Parameters attack technique
    • Supports setting a custom user-agent when accessing the AWS API via the new capability

    4 details in Everything

52. v0.0.19 Jan 24, 2022 · release notes

    Stratus Red Team v0.0.19 adds a reversion function for AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. login profiles.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.19 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v0.0.19

    • Adds reversion support to the aws.persistence.iam-user-create-login-profile technique.

    1 detail in Everything

53. v0.0.18 Jan 21, 2022 · release notes

    Adds stratus cleanup --all command and new CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. log impairment technique

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.18 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v0.0.18

    └──▷ TRY IT
    Remove all deployed techniques from the target account in a single operation.
    copy

    $ stratus cleanup --all

    • Adds cleanup --all subcommand to remove all deployed techniques
    • Adds new cloudtrail_logs_impairment technique

    2 details in Everything

54. v0.0.14 Jan 19, 2022 · release notes

    Stratus Red Team v0.0.14 adds five new AWS attack techniques for red team exercises

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.14 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v0.0.14

    • Adds new attack technique: Backdoor lambda function through resource policy
    • Adds new attack technique: Delete CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. trail
    • Adds new attack technique: Exfiltrate an AMI by Making it Public (shares with external account)
    • Adds new attack technique: Leave the AWS Organization
    • Adds new attack technique: Steal instance credentials from the metadata service

    5 details in Everything

55. v0.0.13 Jan 19, 2022 · release notes

    Stratus Red Team v0.0.13 adds a TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. revert command and improves attack technique display.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.13 https://github.com/datadog/stratus-red-team.git
    # already have the repo? check out this version:
    $ git checkout v0.0.13

    └──▷ USE IT
    Undo a specific attack technique execution to clean up post-exploitation artifacts.
    shell copy

    stratus-red-team revert <attack-technique-id>

    • Adds revert subcommand to undo previously detonated attack techniques
    • Ensures all attack techniques display sufficient operational details in CLI output

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The force flag for the cleanup command has been renamed; existing scripts using the old name will fail.