MITRE Caldera vs Stratus Red Team

MITRE Caldera automates adversary emulation and routine cybersecurity assessments using the MITRE ATT&CK framework. Its listed uses include autonomous emulation, detection and response platform testing, manual red-team work, and red-versus-blue research. Adversary profiles can be used to exercise defenses and train blue teams. The core combines an asynchronous command-and-control server, a REST API, and a web interface; plugins add capabilities including Atomic Red Team techniques, operational technology support, ATT&CK visualizations, incident response, reporting, and training. Its default Sandcat agent is written in Go and supports cross-platform deployment, beaconing, instruction execution, payload downloads, and file uploads. Caldera is free, open source under Apache License 2.0, and intended for on-premises deployment. Installation is documented from source and through Docker, with full and slim container variants. The project lists Linux or macOS and Python 3.10 or later with pip as host requirements, and recommends at least 8 GB RAM and 2 CPUs for the core framework. It advises running Caldera in a secure environment or network because its web interface is not hardened or thoroughly penetration-tested.

Stratus Red Team is a free, open-source Go binary for running specific offensive attack techniques against a live cloud environment and checking detections. Its techniques map to MITRE ATT&CK, with coverage for AWS, Azure, GCP, Kubernetes, Amazon EKS, and Entra ID. For each technique, it can prepare prerequisites, detonate the activity, reverse side effects, and remove prerequisites. Terraform creates and removes required infrastructure, and Stratus downloads its own Terraform binary. Installation options include Go, Homebrew, pre-built Linux, Windows, and macOS binaries, and Docker. The tool can also operate as a Go library for automation and custom techniques. It supports Linux, macOS, Windows, API use, and self-hosting. Documentation recommends an administrator role in a sandbox account or test cluster, not production infrastructure. Kubernetes clusters must already exist, AWS customer-provided detonation infrastructure is unsupported, and Azure resources are fixed to West US.