Threat-Driven Development
summary
Shows Stratus Red Team running repeatable cloud attacks (AWS, Azure, GCP, Kubernetes) by provisioning victim infra with Terraform, executing techniques via the Go SDK and then tearing everything down. Each detonation produces a detonation fingerprint JSON that a Jupyter notebook uses to query telemetry, assert alerts/events, and measure latency. Team runs dozens of tests, finds real detection gaps, assigns investigations into the XDR workflow, and re-runs tests to verify fixes.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:40The Problem
- 2:03Testing with Automated Attacks
- 4:12Stratus Techniques and Providers
- 5:08How Stratus Red Team Works
- 6:10stratus warmup
- 7:17stratus detonate
- 8:32stratus cleanup
- 9:04Testing with Stratus Red Team
- 9:25Detonation Fingerprinting
- 10:43Query XDR for Detonation Side Effects
- 11:29Validate and Compare
- 13:15Create XDR Investigation
- 16:04Review and Tune
- 17:08Rinse and Repeat
- 18:58Lessons Learned
- 22:01Into the Future
- 23:38Recap
related talks
24mPurple Teaming Like Sky’s the Limit – Adversary Emulation in the Cloud...
32mHow to Train your Red Team (for Cloud Native)
29mRed Teaming AWS: Practice What You Preach
12mIntroduction To Red Team Tooling And Opsec
35mRed Teaming AWS: Practice What You Preach/
40mFantastic Red-Team Attacks and How to Find Them
52mBuilding the Always-On Purple Team
22mSecurity vs Dev Experience Threat … or Opportunity