Skip to content
SPECIFICTION
Get listed

Stratus Red Team

stratus-red-team.cloud

WindowsmacOSLinuxAPISelf-hosted
Visit stratus-red-team.cloud
Spec score 7.3 #12 of 20 in Breach and Attack Simulation Software

What it is

Stratus Red Team is a free, open-source Go binary for running specific offensive attack techniques against a live cloud environment and checking detections. Its techniques map to MITRE ATT&CK, with coverage for AWS, Azure, GCP, Kubernetes, Amazon EKS, and Entra ID. For each technique, it can prepare prerequisites, detonate the activity, reverse side effects, and remove prerequisites. Terraform creates and removes required infrastructure, and Stratus downloads its own Terraform binary. Installation options include Go, Homebrew, pre-built Linux, Windows, and macOS binaries, and Docker. The tool can also operate as a Go library for automation and custom techniques. It supports Linux, macOS, Windows, API use, and self-hosting. Documentation recommends an administrator role in a sandbox account or test cluster, not production infrastructure. Kubernetes clusters must already exist, AWS customer-provided detonation infrastructure is unsupported, and Azure resources are fixed to West US.

Spec sheet

Purpose
Stratus Red Team is a self-contained binary for running granular offensive attack techniques against a live cloud environment to validate detections.Read 8 Oct 2026 · stratus-red-team.cloud
Headquarters
New York City, New York, USARead 28 Sep 2026 · stratus-red-team.cloud
Founded
2010Read 28 Sep 2026 · stratus-red-team.cloud
Maker
The documentation copyright is attributed to Datadog, Inc.Read 8 Oct 2026 · stratus-red-team.cloud
ATT&CK mapping
Attack techniques are mapped to MITRE ATT&CK, and the documentation provides coverage matrices by cloud platform.Read 8 Oct 2026 · stratus-red-team.cloud
Attack lifecycle
For a technique, Stratus can prepare prerequisites, detonate the technique, revert side effects, and clean up prerequisites.Read 8 Oct 2026 · stratus-red-team.cloud
Automation
Stratus Red Team can be used programmatically as a Go library for automation and custom attack techniques.Read 8 Oct 2026 · stratus-red-team.cloud
AWS limitation
Using customer-provided detonation infrastructure for AWS techniques is currently unsupported; the tool creates the required infrastructure itself.Read 8 Oct 2026 · stratus-red-team.cloud
Azure limitation
For Azure, the resource location is fixed to West US (California) and cannot be configured.Read 8 Oct 2026 · stratus-red-team.cloud
Azure region limit
For Azure, the location where resources are created is fixed to West US (California) and cannot be configured.Read 8 Oct 2026 · stratus-red-team.cloud
Cloud and cluster coverage
Supported platforms are AWS, Azure, GCP, Kubernetes, Amazon EKS, and Entra ID.Read 8 Oct 2026 · stratus-red-team.cloud
Cloud coverage
It supports AWS, Azure, GCP, Kubernetes, Amazon EKS, and Entra ID.Read 8 Oct 2026 · stratus-red-team.cloud
Cluster prerequisite
Stratus Red Team does not create Kubernetes or EKS clusters and assumes the user is already authenticated to a test cluster.Read 8 Oct 2026 · stratus-red-team.cloud
Custom techniques
The self-contained binary does not dynamically load added techniques, though users can contribute techniques or define them when using the Go library.Read 8 Oct 2026 · stratus-red-team.cloud
Detection mapping
Its attack techniques are mapped to MITRE ATT&CK.Read 8 Oct 2026 · stratus-red-team.cloud
Format
It is a self-contained Go binary that embeds the attack techniques it supports emulating.Read 8 Oct 2026 · stratus-red-team.cloud
Infrastructure setup
It uses Terraform behind the scenes to create and remove attack-technique prerequisites, and downloads its own Terraform binary.Read 8 Oct 2026 · stratus-red-team.cloud
Install options
The getting-started guide lists Go installation, Homebrew, pre-built Linux, Windows and macOS binaries, and Docker.Read 8 Oct 2026 · stratus-red-team.cloud
Installation
Installation options include Go, Homebrew, pre-built binaries for Linux, Windows, and macOS, and Docker.Read 8 Oct 2026 · stratus-red-team.cloud
Kubernetes limitation
Stratus does not create or destroy Kubernetes clusters; it uses an existing cluster and creates required prerequisite resources.Read 8 Oct 2026 · stratus-red-team.cloud
Permissions
The FAQ recommends using Stratus Red Team with an administrator role in a sandbox cloud account or Kubernetes cluster.Read 8 Oct 2026 · stratus-red-team.cloud
Production warning
The getting-started guide says to use it against a sandbox cloud account that does not handle production workloads or infrastructure.Read 8 Oct 2026 · stratus-red-team.cloud
State handling
The tool stores state under $HOME/.stratus-red-team, with optional correlation IDs to isolate concurrent executions.Read 8 Oct 2026 · stratus-red-team.cloud
Support and contributions
The documentation directs users with issues to troubleshooting or to open an issue, and says contributions of new techniques are welcome.Read 8 Oct 2026 · stratus-red-team.cloud
Technique extensibility
The FAQ says users cannot add attack techniques to the self-contained binary without contributing to its core.Read 8 Oct 2026 · stratus-red-team.cloud
Technique workflow
Techniques can be warmed up, detonated, reverted, and cleaned up; Terraform is used to create and remove prerequisites.Read 8 Oct 2026 · stratus-red-team.cloud
Testing environment
The documentation says to use Stratus Red Team against a sandbox cloud account that does not handle production workloads or infrastructure.Read 8 Oct 2026 · stratus-red-team.cloud

Strong points and limits

Strong points

  • Free and open source
  • MITRE ATT&CK technique mapping
  • Supports six cloud and cluster targets
  • Prepares and cleans up prerequisites
  • Installable through binaries, Docker, or Go

Limits

  • Requires a sandbox, not production infrastructure
  • Does not create Kubernetes clusters
  • Azure location fixed to West US
  • Standalone binary cannot dynamically load techniques

Who it suits

It suits security teams validating cloud detections with mapped attack techniques. It also fits developers automating simulations through the Go library.

Verdict

Stratus Red Team packages repeatable cloud attack simulations with ATT&CK mapping and cleanup workflows. Check its environment limits and administrator requirement before deployment.

Where Specifiction places it

Alternatives to Stratus Red TeamAll alternatives →