Freedom251 › Breach and Attack Simulation Software

Stratus Red Team

Free plan APILinuxMacSelf-hostedWindows

What Stratus Red Team is

Stratus Red Team is a free, open-source tool for running focused offensive techniques in a live cloud environment to validate security detections. Its techniques map to MITRE ATT&CK and cover AWS, Azure, GCP, Kubernetes, Amazon EKS, and Entra ID. For each technique, it can prepare prerequisites, run the activity, reverse side effects, and clean up prerequisites. Terraform manages infrastructure setup behind the scenes, and the tool downloads its own Terraform binary. Stratus is a self-contained Go binary with installation options including Go, Homebrew, pre-built Linux, Windows, and macOS binaries, and Docker. It can also be used as a Go library for automation and custom techniques; the binary does not dynamically load added techniques. Documentation recommends an administrator role in a sandbox cloud account or Kubernetes cluster and warns against using production environments. Stratus does not create or destroy Kubernetes clusters, and assumes access to an existing test cluster. AWS customer-provided detonation infrastructure is unsupported, while Azure resource location is fixed to West US, California. State is stored under $HOME/.stratus-red-team, with optional correlation IDs for concurrent runs.

Who it suits

Stratus Red Team may suit security teams that want to check cloud detection coverage with controlled attack simulations. It requires a sandbox cloud account or existing test cluster, and its documentation warns against production environments.

What it does well

Free and open source.
Techniques map to MITRE ATT&CK.
Covers six cloud and cluster environments.
Can revert side effects and clean up prerequisites.
Available as a Go library for automation.

What to know first

Documentation warns against production environments.
Does not create or destroy Kubernetes clusters.
Azure resource location is fixed to West US.
Binary cannot dynamically load added techniques.

Limits

The tool is intended for sandbox environments rather than accounts or clusters handling production workloads. It does not create Kubernetes or EKS clusters, Azure resources are placed in West US, and AWS techniques do not support customer-provided detonation infrastructure. Custom techniques cannot be dynamically added to the standalone binary.

Getting started

Visit https://stratus-red-team.cloud/.
Choose an installation route: Go, Homebrew, a pre-built Linux, Windows, or macOS binary, or Docker.
Prepare a sandbox cloud account or an existing authenticated test Kubernetes or EKS cluster.
Use an administrator role for the sandbox environment.
Run a supported technique to prepare prerequisites, detonate it, revert its effects, and clean up.

Verdict

Stratus Red Team offers mapped attack simulations across several cloud and cluster environments, with a workflow for setup and cleanup. Its limitations make a sandbox and careful review of the platform-specific requirements important.

Questions

How much does Stratus Red Team cost?

It is free and open source.

Which environments does it support?

It supports AWS, Azure, GCP, Kubernetes, Amazon EKS, and Entra ID.

Which operating systems and installation routes are available?

The listed platforms include Linux, macOS, Windows, API, and self-hosted. Installation routes include Go, Homebrew, pre-built binaries for Linux, Windows, and macOS, and Docker.

Does Stratus Red Team map techniques to MITRE ATT&CK?

Yes. Its attack techniques are mapped to MITRE ATT&CK, with coverage matrices by cloud platform in the documentation.

Can I add custom attack techniques?

The standalone binary does not dynamically load added techniques. Users can contribute techniques or define them when using Stratus as a Go library.

What environment should I use?

The documentation recommends an administrator role in a sandbox cloud account or Kubernetes cluster that does not handle production workloads or infrastructure.

Facts from Stratus Red Team's own pages

Attack lifecycle: For a technique, Stratus can prepare prerequisites, detonate the technique, revert side effects, and clean up prerequisites. · stratus-red-team.cloud, 8 Oct 2026
ATT&CK mapping: Attack techniques are mapped to MITRE ATT&CK, and the documentation provides coverage matrices by cloud platform. · stratus-red-team.cloud, 8 Oct 2026
Automation: Stratus Red Team can be used programmatically as a Go library for automation and custom attack techniques. · stratus-red-team.cloud, 8 Oct 2026
AWS limitation: Using customer-provided detonation infrastructure for AWS techniques is currently unsupported; the tool creates the required infrastructure itself. · stratus-red-team.cloud, 8 Oct 2026
Azure limitation: For Azure, the resource location is fixed to West US (California) and cannot be configured. · stratus-red-team.cloud, 8 Oct 2026
Azure region limit: For Azure, the location where resources are created is fixed to West US (California) and cannot be configured. · stratus-red-team.cloud, 8 Oct 2026
Cloud and cluster coverage: Supported platforms are AWS, Azure, GCP, Kubernetes, Amazon EKS, and Entra ID. · stratus-red-team.cloud, 8 Oct 2026
Cloud coverage: It supports AWS, Azure, GCP, Kubernetes, Amazon EKS, and Entra ID. · stratus-red-team.cloud, 8 Oct 2026
Cluster prerequisite: Stratus Red Team does not create Kubernetes or EKS clusters and assumes the user is already authenticated to a test cluster. · stratus-red-team.cloud, 8 Oct 2026
Custom techniques: The self-contained binary does not dynamically load added techniques, though users can contribute techniques or define them when using the Go library. · stratus-red-team.cloud, 8 Oct 2026
Detection mapping: Its attack techniques are mapped to MITRE ATT&CK. · stratus-red-team.cloud, 8 Oct 2026
Format: It is a self-contained Go binary that embeds the attack techniques it supports emulating. · stratus-red-team.cloud, 8 Oct 2026
Founded: 2010 · stratus-red-team.cloud, 28 Sept 2026
Headquarters: New York City, New York, USA · stratus-red-team.cloud, 28 Sept 2026
Infrastructure setup: It uses Terraform behind the scenes to create and remove attack-technique prerequisites, and downloads its own Terraform binary. · stratus-red-team.cloud, 8 Oct 2026
Installation: Installation options include Go, Homebrew, pre-built binaries for Linux, Windows, and macOS, and Docker. · stratus-red-team.cloud, 8 Oct 2026
Install options: The getting-started guide lists Go installation, Homebrew, pre-built Linux, Windows and macOS binaries, and Docker. · stratus-red-team.cloud, 8 Oct 2026
Kubernetes limitation: Stratus does not create or destroy Kubernetes clusters; it uses an existing cluster and creates required prerequisite resources. · stratus-red-team.cloud, 8 Oct 2026
Maker: The documentation copyright is attributed to Datadog, Inc. · stratus-red-team.cloud, 8 Oct 2026
Permissions: The FAQ recommends using Stratus Red Team with an administrator role in a sandbox cloud account or Kubernetes cluster. · stratus-red-team.cloud, 8 Oct 2026
Production warning: The getting-started guide says to use it against a sandbox cloud account that does not handle production workloads or infrastructure. · stratus-red-team.cloud, 8 Oct 2026
Purpose: Stratus Red Team is a self-contained binary for running granular offensive attack techniques against a live cloud environment to validate detections. · stratus-red-team.cloud, 8 Oct 2026
State handling: The tool stores state under $HOME/.stratus-red-team, with optional correlation IDs to isolate concurrent executions. · stratus-red-team.cloud, 8 Oct 2026
Support and contributions: The documentation directs users with issues to troubleshooting or to open an issue, and says contributions of new techniques are welcome. · stratus-red-team.cloud, 8 Oct 2026

Where Stratus Red Team stands on Freedom251

Breach and Attack Simulation Software#7 of 20
Offensive Security#8 of 22