Issues

• New possible AWS attack technique: Share an EBS Volume Clone cross-account

  good first issuekind/new-techniqueplatform/aws
  DataDog/stratus-red-team#967 · Filter by author christophetd opened on Sep 14, 2026
  1

• Stratus-Red-Team-level AWS configuration: propagate to detonate/revert

  DataDog/stratus-red-team#942 · Filter by author christophetd opened on Aug 17, 2026
  

• New attack technique: Reuse an Amazon Cognito Refresh Token

  kind/new-techniqueplatform/awspriority/seen-in-the-wild
  DataDog/stratus-red-team#910 · Filter by author Edd88-pixel opened on Jul 25, 2026
  2

• New attack technique: Azure Key Vault Access Policy Modification and Secret Extraction

  kind/new-techniqueplatform/azurepriority/seen-in-the-wild
  DataDog/stratus-red-team#870 · Filter by author christophetd opened on May 21, 2026

• New attack technique: Steal Azure Managed Identity Token via IMDS

  kind/new-techniqueplatform/azurepriority/seen-in-the-wild
  DataDog/stratus-red-team#869 · Filter by author christophetd opened on May 21, 2026

• New attack technique: Azure SQL Server Firewall Rule Modification

  kind/new-techniqueplatform/azurepriority/seen-in-the-wild
  DataDog/stratus-red-team#868 · Filter by author christophetd opened on May 21, 2026

• Ensure examples are continuously in a functioning state

  kind/tech-debt
  DataDog/stratus-red-team#711 · Filter by author christophetd opened on Dec 11, 2025
  

• Review TradeTraitors report and extract relevant TTPS for roadmap

  good first issuekind/documentation
  DataDog/stratus-red-team#692 · Filter by author christophetd opened on Jun 27, 2025

• Add support for AWS Gov Partition

  kind/enhancementplatform/aws
  DataDog/stratus-red-team#656 · Filter by author kclinden opened on Mar 10, 2025
  1

• AWS: Persist by creating an identity provider

  kind/new-techniqueplatform/aws
  DataDog/stratus-red-team#646 · Filter by author christophetd opened on Mar 3, 2025
  1

• Analyze AWS CIRT post and extract relevant TTPs

  good first issuekind/research
  Enhancement

  DataDog/stratus-red-team#594 · Filter by author christophetd opened on Nov 6, 2024
  

• Add logged operations to the "List of all available attack techniques" page

  kind/documentation
  Enhancement

  DataDog/stratus-red-team#582 · Filter by author lsass-exe opened on Oct 5, 2024
  2

• Analyze Sebastian Walla's fwd:cloudsec talk

  good first issuekind/research
  DataDog/stratus-red-team#571 · Filter by author christophetd opened on Sep 19, 2024
  2

• Analyze "ransomware in the cloud" post

  good first issuekind/research
  DataDog/stratus-red-team#568 · Filter by author christophetd opened on Sep 10, 2024
  1

• Investigate potentially undesirable clean-up behavior on error

  DataDog/stratus-red-team#567 · Filter by author christophetd opened on Sep 10, 2024

• Terraform init is painfully slow

  kind/enhancement
  DataDog/stratus-red-team#557 · Filter by author christophetd opened on Aug 28, 2024
  1

• Document permissions required to detonate each attack technique

  kind/enhancement
  DataDog/stratus-red-team#555 · Filter by author christophetd opened on Aug 27, 2024

• New attack techniques: Kubernetes

  kind/new-techniqueplatform/k8s
  DataDog/stratus-red-team#550 · Filter by author micahhausler opened on Aug 8, 2024
  2

• New EKS attack technique: Create new admin cluster access management entry to access the cluster

  kind/new-techniqueplatform/eks
  DataDog/stratus-red-team#540 · Filter by author christophetd opened on Jul 5, 2024 · Hacker Summer Camp 2024

• New attack technique: Lateral movement through GCP Serial Console

  kind/new-techniqueplatform/gcppriority/seen-in-the-wild
  DataDog/stratus-red-team#538 · Filter by author siigil opened on Jul 2, 2024
  1

• New attack technique: Use GCP OSLogin to Push SSH Keys

  kind/new-techniqueplatform/gcp
  DataDog/stratus-red-team#536 · Filter by author siigil opened on Jul 2, 2024

• New attack technique: Login via Azure Serial Console

  kind/new-techniqueplatform/azure
  DataDog/stratus-red-team#533 · Filter by author siigil opened on Jul 2, 2024

• New attack technique: Modify Startup Scripts in Azure VM Custom Data

  kind/new-techniqueplatform/azure
  DataDog/stratus-red-team#532 · Filter by author siigil opened on Jul 2, 2024

• New attack technnique: Exfiltrate disk of Azure VM by snapshotting it

  kind/new-techniqueplatform/azurepriority/seen-in-the-wild
  DataDog/stratus-red-team#510 · Filter by author christophetd opened on Apr 10, 2024

• New attack technique: SendSerialConsoleSSHPublicKey

  kind/new-techniqueplatform/awspriority/seen-in-the-wild
  DataDog/stratus-red-team#487 · Filter by author christophetd opened on Mar 1, 2024
  2