Purple Teaming Like Sky’s the Limit – Adversary Emulation in the Cloud...
summary
Stratus Red Team is an open source tool that reproduces cloud attacks against live AWS and Kubernetes accounts, packaged as a single Go binary with Terraform prerequisites handled automatically. The repo ships 23 AWS attacks and 6 Kubernetes attacks, implements each technique as Go “attack as code,” and shows detonate/warm/clean lifecycle for prepare, execute, and teardown. Demo shows AMI exfiltration and S3 policy backdoor via Terraform-wrapped setup and post-run cleanup, plus CI-friendly programmatic runs and detection-guidance.
AI-written summary · about
chapters (19)
- 0:00Start
- 1:19From detecting indicators of compromise locs...
- 2:28to detecting behaviors
- 2:47MITRE ATT&CK
- 2:57Threat matrix for Kubernetes
- 4:31Detect when VPC Flow Logs are removed
- 6:13Reproducing Cloud Attacks
- 6:46Stratus Red Team
- 7:23Philosophy: Attack techniques
- 8:21Philosophy: Value proposition
- 9:07Attack Techniques Library
- 9:57Anatomy of an Attack Technique
- 11:03Terraform instrumentation
- 11:40Lifecycle of an Attack Technique
- 12:18Other tools
- 19:29What could go wrong?
- 20:25Programmatic interface
- 21:08End-to-end detection testing integration tests
- 22:44Roadmap
related talks
32mThreat-Driven Development
29mRed Teaming AWS: Practice What You Preach
32mHow to Train your Red Team (for Cloud Native)
35mRed Teaming AWS: Practice What You Preach/
40mBeyond Public Buckets: Lessons Learned on Attack Detection in the Cloud
30mTales of Red Teaming
44mLive Hacking Cloud Architectures
47mBreaking the Cloud to Rebuild It: A Tale of 3 ☁️ Breaches!