Stratus Red Team

Stratus Red Team은 클라우드를 위한 "Atomic Red Team™"으로, 공격 기법에 대한 세밀하고 자체 완결적인 에뮬레이션을 제공합니다.

발표 블로그 게시물:

• https://www.datadoghq.com/blog/cyber-attack-simulation-with-stratus-red-team/
• https://blog.christophetd.fr/introducing-stratus-red-team-an-adversary-emulation-tool-for-the-cloud/

시작하기

Stratus Red Team은 자체 완결형 Go 바이너리입니다.

**stratus-red-team.cloud**에서 문서를 참조하세요:

• Stratus Red Team 개념
• Stratus Red Team 설치 - Homebrew formula, Docker 이미지, 사전 빌드된 바이너리 제공
• 사용 가능한 공격 기법, MITRE ATT&CK에 매핑됨

설치

직접 설치

Go 1.26 이상 필요

go install -v github.com/datadog/stratus-red-team/v2/cmd/stratus@latest

Homebrew

brew tap datadog/stratus-red-team https://github.com/DataDog/stratus-red-team
brew install datadog/stratus-red-team/stratus-red-team

사전 빌드된 바이너리

Linux, Windows, macOS용: 사전 빌드된 바이너리 중 하나를 다운로드하세요.

Docker

IMAGE="ghcr.io/datadog/stratus-red-team"
alias stratus="docker run --rm -v $HOME/.stratus-red-team/:/root/.stratus-red-team/ -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_SESSION_TOKEN -e AWS_DEFAULT_REGION $IMAGE"

asdf

asdf와 stratus-red-team 플러그인을 사용하여 stratus-red-team의 특정 버전을 설치합니다:

asdf plugin add stratus-red-team https://github.com/asdf-community/asdf-stratus-red-team.git
asdf install stratus-red-team latest

커뮤니티

커뮤니티의 게시물 및 프로젝트:

오픈소스 프로젝트:

• Threatest
• AWS Threat Detection with Stratus Red Team

영상:

• Reproducing common attacks in the cloud with Stratus Red Team
• Stratus Red Team: AWS EC2 Instance Credential Theft | Threat SnapShot
• Automated Attack Simulation in AWS for Red Teaming

블로그 게시물:

• AWS threat emulation and detection validation with Stratus Red Team and Datadog Cloud SIEM
• Adversary emulation on AWS with Stratus Red Team and Wazuh
• Sky's the Limit: Stratus Red Team for Azure
• Detecting realistic AWS cloud-attacks using Azure Sentinel
• A Data Driven Comparison of Open Source Adversary Emulation Tools
• Making Security Relevant in the Cloud
• Detonating attacks with Datadog Stratus Red Team
• AWS CloudTrail cheatsheet
• Adversary emulation on GCP with Stratus Red Team and Wazuh
• Automated First-Response in AWS using Sigma and Athena
• AWS Cloud Detection Lab: Cloud Pen-testing with Stratus Red Team

발표:

• Purple Teaming & Adversary Emulation in the Cloud with Stratus Red Team, DEF CON Cloud Village 2022
• Threat-Driven Development with Stratus Red Team by Ryan Marcotte Cobb
• Cloudy With a Chance of Purple Rain: Leveraging Stratus Red Team - BSides Portland 2022

논문:

• A Purple Team Approach to Attack Automation in the Cloud Native Environment

Go 라이브러리로 Stratus Red Team 사용하기

예제 및 프로그래밍 방식 사용을 참조하세요.

개발

로컬에서 빌드하기

make
./bin/stratus --help

로컬에서 실행하기

go run cmd/stratus/*.go list

테스트 실행

make test

문서 빌드하기

로컬 사용 시:

pip install mkdocs-material mkdocs-awesome-pages-plugin

make docs
mkdocs serve

감사의 말

핵심 유지관리자: Christophe Tafani-Dereeper (@christophetd), Simon Maréchal (@Minosity-VR).

유사 프로젝트 (Stratus Red Team과의 비교 참고):

• Red Canary의 Atomic Red Team
• F-Secure의 Leonidas
• Rhino Security Labs의 pacu
• Amazon GuardDuty Tester
• Rhino Security Labs의 CloudGoat

영감 및 관련 자료:

• https://expel.io/blog/mind-map-for-aws-investigations/
• https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
• https://github.com/elastic/detection-rules/tree/main/rules/integrations/aws

스킬

다음 에이전트 스킬을 이 저장소에서 사용할 수 있습니다: