Stratus Red Team — The Cyber Toolchain

Stratus Red Team v2.37.2

Wed, 28 Oct 2026 09:55:30 GMT

Stratus Red Team adds an EBS volume cross-account sharing technique to emulate exfiltration via AWS RAM⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds attack technique `aws.exfiltration.ec2-share-ebs-volume` to emulate EBS volume exfiltration by sharing a volume with an external AWS account via AWS Resource Access Manager (RAM) using the `AWSRAMPermissionEBSVolumeCopyAccess` managed permission, mapped to MITRE ATT&CK tactic Exfiltration and technique T1578.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.37.0

Wed, 30 Sep 2026 15:36:48 GMT

Stratus Red Team v2.37.0 adds a new AWS EC2 suspicious keypair persistence technique and improves S3 ransomware detonation reliability.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `aws.persistence.ec2-create-suspicious-keypair` technique, simulating attacker persistence via `ec2:CreateKeyPair` with a short generic name (`xg1`), preceded by an `ec2:DescribeInstances` recon call filtered by key name; mapped to MITRE ATT&CK T1098.001 (Account Manipulation: Additional Cloud Credentials) with no prerequisite Terraform infrastructure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Improves the `aws.impact.s3-ransomware-client-side-encryption` technique to allow SSE-C on target buckets before detonation by calling `PutBucketEncryption` with `BlockedEncryptionTypes` set to `NONE`, enabling `CopyObject` with customer-provided keys to succeed on new buckets that block SSE-C by default. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.36.1

Tue, 22 Sep 2026 14:06:09 GMT

Stratus Red Team v2.36.1 adds concurrent detonation support across all providers, KUBECONFIG multi-path handling, and Azure correlation ID propagation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Propagates Azure correlation IDs via `clientRequestID` (migrated from user-agent) so detonation activity is traceable across Azure API calls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables concurrent detonation across all providers (AWS, Azure, GCP, Entra ID, Kubernetes, EKS) by embedding a short correlation ID (`var.correlation.short`) in Terraform-managed resource names, preventing resource collisions when multiple users share an environment. • Removes dependency on the `az` CLI by bumping the Azure (`azurerm`) Terraform provider to 4.81.0. • Adds opt-out of the Terraform cache to prevent concurrency issues during parallel detonations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.36.0

Tue, 18 Aug 2026 07:45:59 GMT

Stratus Red Team v2.36.0 adds EC2 AMI deregistration, concurrent execution isolation via correlation ID, and configurable AWS resource tags/prefixes. • Adds `STRATUS_RED_TEAM_CORRELATION_ID` environment variable to isolate concurrent attack-technique executions in the same environment, preventing errors and duplicate state. • Adds configurable AWS resource tags and prefixes for resources created during warmup, controlled via the Stratus Red Team configuration file. • New attack technique `aws.impact.ec2-deregister-ami`: deregisters an Amazon EC2 AMI to simulate disruption. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.35.0

Fri, 31 Jul 2026 15:56:28 GMT

Adds new Azure attack technique to emulate AI Foundry API key exfiltration via local auth re-enablement. • New Azure technique `azure.persistence.exfiltrate-foundry-key`: re-enables local (key-based) authentication on an Azure AI Foundry (Cognitive Services) account and retrieves API keys via ListKeys, emulating a Persistence/Credential Access attack path. Breaking changes: • The `azure.persistence.exfiltrate-foundry-key` technique requires the `ARM_SUBSCRIPTION_ID` environment variable (not `AZURE_SUBSCRIPTION_ID`) due to an upgrade to the azurerm Terraform provider 4.80.0. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.34.0

Fri, 10 Jul 2026 14:35:17 GMT

Stratus Red Team v2.34.0 adds Azure App Service credential harvesting, a controllable logger API, and a threat-intel coverage mapping skill. • New Azure attack technique: Retrieve App Service Publishing Credentials (`azure.credential-access.app-service-publishing-credentials`). • New `pkg/stratus/log` package exposes a controllable logger, letting library embedders route Stratus log output through any `slog.Handler` (e.g., zap, logrus). • New `map-threat-intel-coverage` agent skill fetches a threat-intelligence report, extracts cloud TTPs, classifies each against existing Stratus Red Team coverage, and drafts GitHub issues for gaps. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.33.0

Thu, 04 Jun 2026 15:03:49 GMT

Stratus Red Team v2.33.0 adds two Azure Blob Storage ransomware attack techniques targeting encryption key destruction. • New attack technique: simulate Azure Blob Storage ransomware via Customer-Provided Encryption Keys (CPEK). • New attack technique: simulate Azure Blob Storage ransomware via Customer-Managed Key Vault key and vault deletion. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.32.1

Wed, 20 May 2026 12:47:33 GMT

Stratus Red Team v2.32.1 shrinks binary size ~50% and adds detonation ID templating in config files. • Enables detonation ID templating in the Stratus Red Team configuration file, e.g. for injecting the ID into Kubernetes pod labels. • Reduces the Stratus Red Team binary size by roughly 50%, lowering download and deployment overhead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.32.0

Wed, 20 May 2026 08:07:46 GMT

Stratus Red Team v2.32.0 adds three new GCP attack techniques including Vertex AI abuse and GCS ransomware simulations. • New GCP technique: Inject a Malicious Startup Script into a Vertex AI Workbench Instance (`gcp.execution.modify-vertex-notebook-startup`). • New GCP technique: GCS Ransomware through individual file deletion (`gcp.impact.gcs-ransomware-individual-deletion`). • New GCP technique: GCS Ransomware through client-side encryption (`gcp.impact.gcs-ransomware-client-side-encryption`). • Kubernetes resources are now labeled with `datadoghq.com/stratus-red-team-stage=warmup|detonation` to distinguish warmup from detonation resources. • Kubernetes configuration now supports pod annotations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.31.0

Tue, 14 Apr 2026 08:49:47 GMT

Stratus Red Team v2.31.0 adds 9 new attack techniques across Azure, Entra ID, and GCP plus expanded programmatic runner options. • Adds Azure persistence technique: Backdoor Azure Managed Identity with Federated Identity Credential (FIC). • Adds Entra ID persistence technique: Backdoor Entra ID application with Federated Identity Credential (FIC). • Adds GCP defense-evasion technique: Attempt to Remove a GCP Project from its Organization. • Adds GCP defense-evasion technique: Delete a Cloud DNS Logging Policy. • Adds GCP defense-evasion technique: Disable Data Access Audit Logs for a GCP Service. • Adds GCP defense-evasion technique: Disable VPC Flow Logs on a Subnet. • Adds GCP defense-evasion technique: Disable a GCP Log Sink. • Adds GCP discovery technique: Read GCE Instance Metadata via the Compute API. • Adds GCP defense-evasion technique: Reduce Log Retention Period on a Cloud Logging Sink Bucket. • Programmatic usage now supports an S3 bucket for internal and Terraform state storage. • Programmatic usage now supports custom StateManager, TerraformManager, ProviderFactory, Config, and CorrelationID when launching the runner. • Programmatic usage now supports supplying an existing Terraform binary instead of downloading its own. • Programmatic usage now supports configurable cloud credentials rather than relying on environment variables. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.30.0

Thu, 26 Mar 2026 16:50:24 GMT

Stratus Red Team v2.30.0 adds YAML configuration file support for persistent CLI settings. • Supports a YAML configuration file for managing Stratus Red Team settings without passing flags on every invocation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.29.0

Mon, 09 Mar 2026 15:09:35 GMT

Stratus Red Team v2.29.0 adds an Entra ID attack technique to elevate privileges to User Access Administrator at root scope. • New attack technique: Elevate to User Access Administrator at Root Scope targeting Entra ID environments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.27.0

Thu, 12 Feb 2026 15:57:55 GMT

Stratus Red Team v2.27.0 adds four new GCP attack techniques covering compute abuse, credential theft, and permission enumeration. • New GCP technique: simulate cryptomining-style impact by creating GCE instances across multiple zones (`gcp.impact.create-instances-in-multiple-zones`). • New GCP technique: create a GCE GPU virtual machine instance to emulate GPU-hungry workload abuse (`gcp.impact.create-gpu-vm`). • New GCP technique: steal and replay a GCE default service account token from outside Google Cloud to simulate initial access (`gcp.initial-access.use-compute-sa-outside-gcp`). • New GCP technique: enumerate all permissions of a GCP service account to simulate post-compromise discovery (`gcp.discovery.enumerate-permissions`). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.26.0

Tue, 10 Feb 2026 16:17:54 GMT

Stratus Red Team v2.26.0 adds Azure Blob Storage ransomware and GCP SSH key injection attack techniques. • New Azure attack technique: simulate Blob Storage ransomware via Encryption Scope using a client-managed Key Vault key (`azure.impact.blob-ransomware-client-encryption-scope`). • New GCP attack technique: register an SSH public key to instance metadata for lateral movement simulation (`gcp.lateral-movement.add-sshkey-instance-metadata`). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.25.0

Wed, 04 Feb 2026 17:13:33 GMT

Stratus Red Team v2.25.0 adds three new Azure attack techniques covering storage exfiltration and resource lock deletion. • New technique: Exfiltrate Azure Storage via public access (`azure.exfiltration.storage-public-access`) • New technique: Exfiltrate Azure Storage through SAS URL (`azure.exfiltration.storage-sas-export`) • New technique: Delete Azure resource lock (`azure.impact.resource-lock`) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.24.0

Wed, 04 Feb 2026 11:48:16 GMT

Stratus Red Team v2.24.0 adds Azure blob ransomware simulation and AWS SageMaker command execution techniques. • New attack technique: simulate Azure ransomware via Storage Account Blob deletion (`azure.impact.blob-ransomware-individual-file-deletion`). • New attack technique: execute commands on an AWS SageMaker Notebook Instance via Lifecycle Configuration (`aws.execution.sagemaker-update-lifecycle-config`). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.23.0

Fri, 14 Feb 2025 15:16:08 GMT

Stratus Red Team v2.23.0 adds a GCP attack technique to mass-retrieve Secret Manager secrets. • New GCP credential-access technique: simulate bulk retrieval of a high number of Secret Manager secrets (`gcp.credential-access.secretmanager-retrieve-secrets`). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.20.0

Wed, 04 Dec 2024 16:18:11 GMT

Stratus Red Team v2.20.0 adds two new AWS attack techniques for EC2 serial console abuse and STS federation token persistence. • New attack technique: simulate lateral movement via EC2 Serial Console by pushing an SSH public key to multiple instances using `SendSerialConsoleSSHPublicKey`. • New attack technique: simulate persistence by generating temporary AWS credentials with `GetFederationToken` via STS federation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.19.0

Mon, 21 Oct 2024 20:52:14 GMT

Stratus Red Team v2.19.0 adds an Azure attack technique for VM access via Bastion shareable links. • New Azure attack technique `azure.create-bastion-shareable-link`: simulates adversary access to a Virtual Machine using an Azure Bastion shareable link. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.17.0

Tue, 17 Sep 2024 05:24:43 GMT

Stratus Red Team v2.17.0 adds Entra ID attack techniques and a new AWS IAM login profile attack. • Adds Microsoft Entra ID attack techniques, expanding adversary simulation coverage to Azure identity infrastructure. • New AWS attack technique: Update IAM user login profile (`aws.credential-access.update-iam-user-login-profile`), simulating credential takeover via console access manipulation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.16.0

Fri, 02 Aug 2024 22:40:26 GMT

Stratus Red Team v2.16.0 adds initial EKS attack technique support for Kubernetes-on-AWS adversary simulation. • Adds initial support for EKS attack techniques, enabling adversary simulation against Amazon Elastic Kubernetes Service environments. • Allows specifying a context when instantiating Stratus Red Team runners, propagating it down to Terraform for more flexible programmatic use. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.14.0

Fri, 09 Feb 2024 13:47:31 GMT

Stratus Red Team v2.14.0 adds four new AWS attack techniques • Adds `aws.defense-evasion.dns-delete-logs` technique to delete DNS query logs in AWS. • Adds `aws.execution.ssm-start-session` technique for launching SSM StartSession on multiple instances. • Adds `aws.persistence.iam-create-backdoor-role` technique to create a backdoored IAM Role. • Adds `aws.execution.ssm-send-command` technique for using ssm:SendCommand on multiple instances. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.13.0

Tue, 30 Jan 2024 11:38:16 GMT

Stratus Red Team v2.13.0 adds the `ec2instanceconnect:SendSSHPublicKey` technique to multiple instances • Adds support for the `ec2instanceconnect:SendSSHPublicKey` attack technique targeting multiple EC2 instances simultaneously Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.12.0

Wed, 29 Nov 2023 14:59:47 GMT

Stratus Red Team v2.12.0 adds new GCP attack techniques for exfiltrating Compute Images and Disks via sharing. • Adds the `gcp.exfiltration.share-compute-image` technique to exfiltrate Compute Images by sharing them • Adds the `gcp.exfiltration.share-compute-snapshot` technique to exfiltrate Compute Disks by sharing a snapshot Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.11.0

Mon, 27 Nov 2023 15:15:30 GMT

Stratus Red Team v2.11.0 adds `secretsmanager-batch-retrieve-secrets` attack technique leveraging AWS BatchGetSecretValue. • Adds the `AWS/aws.credential-access.secretsmanager-batch-retrieve-secrets` technique to dump secrets via Secret Manager's `BatchGetSecretValue` API Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.9.0

Fri, 25 Aug 2023 14:23:12 GMT

Stratus Red Team v2.9.0 adds 3 new AWS S3 ransomware attack techniques • `aws.impact.s3-ransomware-individual-deletion` technique to simulate ransomware by deleting S3 files individually • `aws.impact.s3-ransomware-batch-deletion` technique to simulate ransomware by deleting S3 files in batch • `aws.impact.s3-ransomware-client-side-encryption` technique to simulate ransomware via client-side encryption of S3 objects Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.8.0

Tue, 27 Jun 2023 08:05:29 GMT

Stratus Red Team v2.8.0 adds a new GCP persistence technique to backdoor a service account via its IAM policy. • Adds `GCP/gcp.persistence.backdoor-service-account-policy` attack technique to the CLI for testing IAM misconfigurations Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.6.0

Tue, 20 Jun 2023 13:35:52 GMT

Stratus Red Team v2.6.0 adds GCP compute disk exfiltration technique • Adds `gcp.exfiltration.share-compute-disk` technique for GCP Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.5.4

Wed, 03 May 2023 08:19:26 GMT

Stratus Red Team v2.5.4 auto-installs shell completions via Homebrew • Adds automatic installation of shell completions for bash, zsh, and fish when installing Stratus Red Team via Homebrew Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.4.9

Tue, 22 Nov 2022 10:32:33 GMT

Stratus Red Team v2.4.9 adds YAML generation for available attack techniques via `make docs` • `make docs` now generates a YAML file with all available attack techniques Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v2.3.0

Sat, 13 Aug 2022 15:46:23 GMT

Stratus Red Team v2.3.0 adds GCP support • `GCP` is now a supported cloud provider for executing red team techniques. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v1.7.0

Wed, 06 Apr 2022 15:48:20 GMT

Stratus Red Team v1.7.0 adds unique UUID in User-Agent header for execution tracking • `User-Agent` headers for Kubernetes and AWS API requests now include a unique `stratus-red-team_` identifier Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v1.5.0

Mon, 28 Feb 2022 15:49:06 GMT

Stratus Red Team v1.5.0 adds the `k8s.credential-access.dump-secrets` attack technique to dump Kubernetes cluster secrets. • Adds `k8s.credential-access.dump-secrets` TTP for dumping all secrets of a K8s cluster Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v1.4.0

Thu, 10 Feb 2022 08:20:25 GMT

v1.4.0 adds three new K8s attack techniques and parallelizes `warmup`, `detonate` and `cleanup` for multi-technique runs • Adds `k8s.privilege-escalation.privileged-pod` attack technique to spawn a privileged Kubernetes pod. • Adds `k8s.persistence.create-admin-clusterrole` attack technique to create an admin ClusterRole in Kubernetes. • Adds `k8s.credential-access.steal-serviceaccount-token` attack technique to steal a pod service account token in Kubernetes. • Parallelizes command execution when running `stratus warmup`, `stratus detonate`, or `stratus cleanup` on multiple attack techniques simultaneously. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v0.0.20

Tue, 25 Jan 2022 15:00:36 GMT

Stratus Red Team v0.0.20 adds three new AWS attack techniques and custom user-agent support. • Adds `Disable CloudTrail Logging Through Event Selectors` attack technique • Adds `Exfiltrate an RDS snapshot` attack technique • Adds `Retrieve And Decrypt SSM Parameters` attack technique • Supports setting a custom user-agent when accessing the AWS API via the new capability Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v0.0.19

Mon, 24 Jan 2022 12:23:14 GMT

Stratus Red Team v0.0.19 adds a reversion function for AWS IAM login profiles. • Adds `reversion` support to the `aws.persistence.iam-user-create-login-profile` technique. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v0.0.18

Fri, 21 Jan 2022 12:03:34 GMT

Adds `stratus cleanup --all` command and new CloudTrail log impairment technique • Adds `cleanup --all` subcommand to remove all deployed techniques • Adds new `cloudtrail_logs_impairment` technique Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v0.0.14

Wed, 19 Jan 2022 23:18:13 GMT

Stratus Red Team v0.0.14 adds five new AWS attack techniques for red team exercises • Adds new attack technique: Backdoor lambda function through resource policy • Adds new attack technique: Delete CloudTrail trail • Adds new attack technique: Exfiltrate an AMI by Making it Public (shares with external account) • Adds new attack technique: Leave the AWS Organization • Adds new attack technique: Steal instance credentials from the metadata service Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team

Stratus Red Team v0.0.13

Wed, 19 Jan 2022 15:00:13 GMT

Stratus Red Team v0.0.13 adds a TTP revert command and improves attack technique display. • Adds `revert` subcommand to undo previously detonated attack techniques • Ensures all attack techniques display sufficient operational details in CLI output Breaking changes: • The `force` flag for the cleanup command has been renamed; existing scripts using the old name will fail. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stratus-red-team