►
From YouTube: Purple Teaming Like Sky’s the Limit – Adversary Emulation in the Cloud... Christophe Tafani-Dereeper
Description
Purple Teaming Like Sky’s the Limit – Adversary Emulation in the Cloud with Stratus Red Team - Christophe Tafani-Dereeper, Datadog
Engineering and Security teams are increasingly operating in the cloud. With that comes the need to identify malicious activity in cloud-native environments such as AWS or Kubernetes. In this context, it’s critical that we ask ourselves: what does malicious activity look like in the cloud? What are common attacker and malware tactics we should prioritize detecting? How do we reproduce these against a live cloud environment, in order to validate our logging and threat detection pipelines? In this talk, we’ll present Stratus Red Team: an open-source project for adversary emulation and validation of threat detection in the cloud. We’ll discuss the motivation behind the project, the journey and design decisions behind it, but also the philosophy we stand for: focusing on documenting and emulating real-world, documented, and sighted attack techniques. We’ll conclude by a live demo where we use Stratus Red Team to detonate attack techniques against a live AWS account. https://github.com/DataDog/stratus-red-team
A
Hello,
everyone
thanks
a
lot
for
coming
today.
I
hope
you
are
having
a
great
time
at
the
conference.
I
could
not
make
it
to
valencia
today.
So
what
you're
going
to
see
next
is
a
version
of
this
talk
that
I
recorded
a
couple
of
weeks
ago.
Just
for
you.
That
said,
I
am
hanging
in
the
chat
right
now.
So
I'm
looking
forward
to
the
questions
and
the
discussions
that
we're
going
to
have
together,
let's
get
started.
A
A
I
want
to
stop
for
a
bit
on
how,
as
an
industry,
we
work
on
detecting
malicious
activity.
A
few
years
ago,
we
used
to
to
use
mostly
indicators
of
compromise
things
like
hashes
ip
addresses,
binary
names.
Things
like
that,
because
the
idea
is
that
it's
pretty
easy
to
share
those
across
organizations
and
that
if
you
share
that
with
partners
organization,
it's
easy
for
them
to
prevent
some
attacks,
because
a
lot
of
that
is
going
to
reuse
the
same
infrastructure.
A
A
For
ip
addresses
is
the
same
domain
names
iftar,
and
this
figure
here
you
see,
is
called
the
pyramid
of
pain
and
basically,
as
you
move
up,
this
pyramid
things
become
much
harder
to
change
for
an
attacker
and,
if
you
think
about
the
tools
or
the
way
that
they
work,
maybe
how
they
persist,
how
they
exfiltrate
data,
which
is
something
that
they
are
typically
not
going
to
change
easily
and
for
defenders.
It's
a
bit
around
the
opposite.
A
If
you
think
about
a
hash
or
an
ip
address,
it's
pretty
simple
to
detect.
If
you
think
about
tools
and
behaviors,
it
gets
harder.
So
generally,
as
an
industry,
we've
been
moving
towards
detecting
not
only
hashes
ip
addresses
domain
names
and
this
kind
of
indicators
of
compromise,
but
also
more
behavioral
things,
and
so
there
are
a
few
models
that
exist
to
to
model
how
attackers
work,
what
behaviors
they
have.
The
most
famous
is,
of
course,
micro
attack,
which
is
also
a
version
for
cloud
and
for
containers,
there's
also
the
kubernetes
threat
matrix
from
microsoft.
A
A
Now
the
way
that
this
usually
works.
Let's
say
I
want
to
detect
a
specific
kind
of
attack,
I'm
going
to
first
try
to
reproduce
it
to
see
how
it
works.
I'm
going
to
see
what
kind
of
logs
do
I
have.
What
kind
of
alerts
can
I
leverage
anything
that
I
have
to
detect
that
so
I'm
going
to
craft
this
detection
and
I'm
going
to
iterate
on
this
feedback
loop
to
make
my
detection
better
and
the
main
issue
that
we
see
is
that
reproducing
the
attacks
is
pretty
hard
in
the
context
of
cloud
environments?
A
A
A
A
A
Okay,
then
we
see
that
we
need
to
attach
a
trust
policy
to
the
role
that
allows
the
vpc
flux
configuration
to
assume
it.
And
you
know
at
this
point:
we
are
not
really
doing
what
we
wanted
anymore
and
in
the
end,
what
we
noticed
is
that
we
spend
a
lot
of
times
setting
up
the
right
cloud
infrastructure,
configuring
things
and
actually
very
little
time,
testing
our
threat
detection.
A
So
that's
really
around
these
two
challenges
that
we
built
stratus
a
team.
First,
one
being,
how
do
we
handle
complex
testing
prerequisites
in
aws
in
kubernetes?
And
second
one
is
as
an
industry.
We
have
to
be
very
honest
that
the
cloud
and
containers
are
still
a
pretty
new
topic,
so
we
don't
have
a
lot
of
good
data
on
incidents
in
the
wild.
A
A
The
first
question
that
we
had
when
building
it
was
what
kind
of
attack
techniques
do
we
want
to
package
and
the
philosophy?
What
we
ended
up
is
two
things.
First,
we
want
all
the
attack
techniques
to
be
as
good
and
as
you'll
see
in
a
bit.
They
are
defined
as
go
code
and
they
are
from
code.
Then
we
want
to
be
very
opinionated
and
intentional
about
the
attack
techniques
that
we
have
vaccine
we
want
is
we
want
them
to
be
actionable
for
defenders?
A
So,
as
a
defender,
you
should
be
able
to
go
to
the
status
quo
team
documentation
and
to
understand
things
to
like
to
better
understand
what
it
does
and
how
the
attack
techniques
in
the
cloud
work
and
second
thing-
we
want
them
to
be
threat
informed.
Essentially,
we
don't
want
attack
techniques
that
are
super
new,
that
no
one
uses
and
that
no
one
should
care
about.
So
we
try
to
prioritize
a
lot
attacks
that
have
been
seen
in
the
wild
that
are
used
by
pentesters
by
returners
by
offensive
tools.
A
So
again,
strategy
is
really
around
these
two
things.
First,
the
catalog
of
cloud
attack
techniques
and,
in
some
sense
it's
similar
to
my
true
attack,
except
that
we
are
not
scared
about
going
very
deep
and
being
very
specific
to
a
single
cloud
provider
like
aws,
whereas
my
attack
is
more
trying
to
get
like
the
common
ground
and
not
trying
to
be
too
specific
to
a
single
service,
and
second
thing
is
to
have
an
easy
way
to
reproduce:
the
attack
techniques
in
a
live
environment.
A
Currently,
stratus
rating
has
23
aws
attacks
and
six
kubernetes
one.
You
can
see
the
full
list
on
the
website
stratustration.cloud
it
has
the
user
guide
the
reference
of
all
the
attack
techniques
on
the
left.
You
will
see
they
are
sorted
by
platform,
so
you
have
some
for
aws
and
if
you
scroll
down,
you
will
see
them
for
humanities.
A
Now,
let's
stop
for
a
minute
and
have
a
look
at
a
specific
attack
technique
see
what
it
looks
like
and
how
it's
implemented.
This
one
is
going
to
be
about
stopping
a
clockwise
trial.
Cloudtrail
is
a
way
in
aws
that
you
can
log
all
the
api
calls
that
are
made
to
aws
and
it's
super
important
for
defenders.
A
So
it's
interesting
for
an
attacker
to
stop
it
so
that
your
defenders
are
basically
blind.
First
thing
you
will
see
if
you
go
to
the
documentation
of
an
attack.
Technique
is
the
name
the
platform.
When
you
will
see
the
mapping
to
my
true
attack,
you
will
see
a
description
about
what
it
does,
how
it
works.
And
finally,
you
will
see
some
detection
leads
and
the
idea
here
is
not
to
give
a
precise,
a
precise
rule,
it's
more
to
say
which
lock
sources
you
have
at
your
disposal
to
try
to
detect.
A
A
Typically
here,
the
attack
is
around
stopping
a
trailer.
So
first
you
need
a
child
and
you
need
an
s3
bucket
to
which
the
logs
are
going
to
be
sent.
You
need
to
have
the
right
role,
the
right
permissions
so
that
this
works
smoothly,
and
the
goal
of
that
is
way
to
encapsulate
all
this
complexity,
so
that
you
can
just
say:
go
ahead,
prepare
this
infrastructure
for
me
and
I
want
to
be
ready
to
reproduce
the
attack
again.
This
is
totally
transparent,
so
stratified
team
doesn't
mess
with
your
terraform
version.
A
Then
we
have
the
attack
as
code
that
is
written
in,
go
so
in
an
imperative
way,
using
the
aws
or
kubernetes
sdk,
and
this
is
really
what
the
attack
is
about.
So
now
that
I
have
my
trail
ready,
I
know
that
to
approach
the
attack,
I
need
to
stop
it
and
in
terms
of
life
cycle,
an
attack
technique
is
going
to
live
through
three
life
cycles.
First
is
going
to
be
called.
This
is
the
initial
state
where
you
didn't
start
to
work
with
it.
A
A
A
There
are
a
few
tools
that
that
can
be
quite
similar
to
stratus
rating,
so
I
just
want
to
comment
on
it
and
there
is
a
page
that
explains
this
into
more
detail.
So
atomic
team
is
more
focused
on
endpoints
leonidas
by
f-secure
is
a
great
tool.
It's
a
bit
more
complex
to
set
up
and
also
has
more
features.
A
A
Let's
start
with
the
github
repository
on
the
repository,
you
will
have
the
source
code,
the
instructions
to
install
it.
So
typically,
you
can
install
it
through
homebrew.
You
can
download
one
of
the
pre-built
binaries
that
are
available
for
linux,
mac
and
windows,
or
you
can
also
use
the
docker
image.
What
is
it
here?
A
There's
also
a
website
stratostrateam.cod,
and
if
you
go
there,
you
will
see
that
you
have
a
user
guide.
You
have
frequently
asked
questions
around
the
permissions
that
you
need
how
it
works
with
its
state.
How
can
you
package
your
own
attack
technique
and
some
questions
around
the
design
choices?
Then
there
is
the
comparison
with
overtools.
That
is
a
bit
more
detailed
about
what
we
did
in
in
the
slides
again
on
how
to
contribute
and
in
the
user
guide,
you
will
find
some
installation
instructions.
A
Some
examples,
some
work
through
on
how
to
use
it
with
aws,
which
is
just
quite
simple,
as
we'll
see
in
a
bit
and
some
references
around
the
commands,
as
well
as
a
troubleshooting
guide
and
some
more
information
on
how
to
use
it.
Programmatically
and
we'll
see
that
in
a
bit
now
the
interesting
part
is
around
the
attack
techniques
reference.
A
So
if
you
go
there,
you
will
see
first,
the
listing
of
all
the
attack
techniques
that
we
have
iws
for
humanities.
You
have
some
more
background
on
the
philosophy
of
what
we
expect
from
all
these
attack
techniques.
So
we
want
them
to
be
granular.
We
want
them
to
emulate
actual
attacker
activity
and
we
want
them
to
be
self-sufficient,
meaning
that
we
should
be
able
to
reuse
any
of
these
attack
techniques
without
making
any
assumptions
around
the
state
of
your
aws
account
or
humanities
cluster.
A
A
A
A
Now,
if
you
do
stretch
your
status,
you
will
see
the
statutes
of
each
of
your
attack
techniques.
So
here
I
can
see
they
are
all
called
because
I
didn't
start
to
work
with
any
of
these.
So
what
I'm
going
to
do
now
is
I'm
going
to
select
two
attack
techniques,
so
this
one
is
filtration
of
an
ami
and
I'm
going
to
warm
it
up.
A
Now,
what's
going
to
happen
is
that
stratified
team
is
going
to
instrument
terraform
under
the
hood?
It's
going
to
do
a
terraform
apply
of
my
prerequisites,
and
here
the
prerequisites
are
going
to
be
just
an
amazon
machine
image,
but
I
need
to
be
able
to
reproduce
the
attack
all
right.
Now.
It's
telling
me
my
ami
is
ready.
I'm
going
to
warm
up.
Another
attack
technique,
this
one,
which
is
going
to
be
around
backdooring
an
s3
bucket
policy.
A
I
see
that
it
has
created
my
s3
bucket
and
if
I
do
a
stratus
status,
I
will
see
that
these
two
attack
techniques
are
now
warm,
so
it
considers
that
they
are
ready
to
be
used.
They
are
ready
to
be
designated.
If
I
go
to
my
aws
console-
and
I
look
at
my
list
of
amazon
machine
images,
I
will
see
that
now
I
have
an
ami
created
by
status
rat
team.
Similarly,
for
my
s3
bucket,
if
I
go
there
and
I
search
for
them,
I
will
see
I
have
one
bucket
created
by
stratus
red
team.
A
A
A
A
A
And
now
I
see
that
the
attack
things
are
called,
so
I
am
confident
that
I
don't
have
any
infrastructure
left
in
my
aws
account
and
that's
it.
So
what
we
have
done
is
we
have
reproduced
two
attack
techniques
very
easily.
We
use
the
warm
up,
then
the
detonate
command,
but
if
we
just
do
stratus
detonate
it's
going
to
warm
it
up
and
then
detonate
it
and
in
the
end
we
just
do
a
clean
up
and
it
works
the
same.
A
A
A
Your
detection
rules
are
going
to
run
on
these
parts
logs
and
you're
going
to
get
some
alerts.
The
issue
with
that
is
that
it's
pretty
sure
that
at
some
point
something
is
going
to
break.
Maybe
your
trade
is
not
going
to
log
it
anymore.
Maybe
the
permissions
on
the
extra
bucket
are
going
to
be
messed
up,
etc,
etc.
A
So
how
can
we
test
that?
And
the
idea
is
to
consider
all
of
this
as
a
black
box
to
poke
from
one
end,
using
statusrt
team
and,
from
the
other
side,
try
to
use
the
api
of
your
sim
of
your
logs
management
solution
to
confirm
that
an
alert
is
created
and
we
can
do
that
using
the
programmatic
interface
of
status
reteam.
Basically,
you
can
use
strategist
team
as
a
go
library.
So
if
you
go
get
github.com.org
team,
you
can
use
it
from
your
code
and
there
is
some
automatically
generated
good
documentation
as
well.
A
A
You
warm
it
up.
Finally,
you
can
detonate
it,
so
it's
basically
the
same
as
we
did
in
the
demo,
except
that
we
can
do
it
programmatically
as
well,
and
once
we
have
that
we
can
basically
poke
from
one
end
so
detonate
the
attack
technique.
Programmatically
satisfy
team
is
going
to
inject
a
unique
identifier
in
the
user
agent
and
then
we
can
go
ahead
and
look
in
our
cm
if
we
have
an
alert
for
what
we
expect
but
corresponds
to
the
logs
with
the
same
unique
identifier.
A
So
typically
in
cloudtrail
you're
going
to
be
able
to
see
the
user
agent,
and
this
allows
it
to
correlate
this
specific
run
of
strategic
with
alert
that
we
get
and
once
we
confirm
the
alert
is
there
we're
happy,
because
we
know
that
we
triggered
an
attack,
the
real
one
and
what
we
have
earlier,
that
we
expect
it's
going
to
look
like
that.
Typically,
so
you
detonate
the
attack
technique.
A
You
query
the
security
layers
of
your
sim
of
your
logs
management
solution
and
once
you
have
it
so
typically
it's
going
to
take
a
few
seconds
for
kubernetes.
It's
going
to
take
more
around
five
to
ten
minutes
for
club
trail
you're
going
to
see
the
alerts
you
can
mark
it
as
raid
you
can
archive
it.
You
can
close
it
and
at
this
point,
you're
happy,
because
you
confirmed
that
this
is
working
end
to
end.
A
What's
nice
with
it
is
that
you
can
run
inside
a
continuous
integration,
you
can
run
that
on
a
nightly
basis
and
you
can
have
some
kind
of
dashboard
where
you
say
today.
I
tested
these
attack
techniques.
They
worked,
they
didn't
work.
You
can
have
smaller
space
on
that.
So
I
think
it's
a
nice
way
to
make
sure
that
your
most
important
attack
techniques
are
being
detected
as
you
expect,
and
to
be
alerted
when
it's
not
the
case.
A
A
So
thanks
a
lot,
I'm
super
happy
that
you
showed
up
today,
I'm
hanging
out
in
the
chat
to
answer
any
questions,
to
discuss
anything
so
feel
free
to
ask
questions
and
go
ahead
and
visit
the
website.
The
repository
and
feel
free
to
send
me
a
message.
If
you
want
to
discuss
anything
thanks
a
lot
and
have
a
great
day.