Leonidas
A framework for executing and detecting cloud attacker TTPs via YAML definitions, generating APIs, Sigma rules, and documentation.
What is Leonidas?
Leonidas is a framework for automated attack simulation in cloud environments that executes predefined attacker tactics, techniques, and procedures (TTPs). It allows security teams to validate their detection capabilities by simulating real-world attacks and automatically generating corresponding detection rules and documentation. The framework uses YAML definitions to describe attacker actions across AWS and Kubernetes platforms.
Cloud security engineers, detection engineers, and red/blue teams working in AWS or Kubernetes environments who need to test and improve their security monitoring capabilities.
Leonidas provides a structured, repeatable approach to cloud attack simulation with built-in detection generation, eliminating manual correlation between attacks and detection logic. Its YAML-based definition system makes TTPs portable and version-controllable, while supporting both AWS and Kubernetes environments.
Overview
Automated Attack Simulation in the Cloud, complete with detection use cases.
Use Cases
Best For
- Validating cloud security monitoring and detection rules
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.