Atomic Red Team vs Stratus Red Team

Atomic Red Team is a free library of tests security teams can run to check controls, validate visibility, and assess detection coverage. Its tests emulate adversary behaviors and map to the MITRE ATT&CK matrix. They have few dependencies and use a structured format suited to automation frameworks. Invoke-AtomicRedTeam is a PowerShell module for testing defenses against attack techniques; it can run tests locally or on remote machines through PowerShell Remoting. Atomic Runner can run a configurable list unattended, once per week by default. The project includes a Ruby API to validate tests and generate documentation, and pulls ATT&CK data in STIX form. Listed integrations include Microsoft Defender for Endpoint, AttackIQ, Datadog Workload Security Evaluator, OpenBAS, Splunk Attack Range, and Tidal Cyber. Coverage includes Windows, Linux, macOS, cloud infrastructure, containers, SaaS, Azure AD, Google Workspace, Office 365, and IaaS providers. Tests can be chained manually, but there is no automated solution for emulating a specific attack group as a whole. Users are instructed to obtain permission from the environment owner before running a test.

Stratus Red Team is a free, open-source Go binary for running specific offensive attack techniques against a live cloud environment and checking detections. Its techniques map to MITRE ATT&CK, with coverage for AWS, Azure, GCP, Kubernetes, Amazon EKS, and Entra ID. For each technique, it can prepare prerequisites, detonate the activity, reverse side effects, and remove prerequisites. Terraform creates and removes required infrastructure, and Stratus downloads its own Terraform binary. Installation options include Go, Homebrew, pre-built Linux, Windows, and macOS binaries, and Docker. The tool can also operate as a Go library for automation and custom techniques. It supports Linux, macOS, Windows, API use, and self-hosting. Documentation recommends an administrator role in a sandbox account or test cluster, not production infrastructure. Kubernetes clusters must already exist, AWS customer-provided detonation infrastructure is unsupported, and Azure resources are fixed to West US.